- prefer storm_multi_line sourcetype