add a multiline filter to logstash