I'm using Logstash to index files where separate lines relate to the same event, thus I want to use multi_line.
What is the difference between using a multi_line codec in my input plugin versus using the multi_line filter plugin?
Is there a use case where one is better than the other?
Thanks,
Chris