logstash多行处理

插件logstash-filter-multiline

1、离线安装：

## 到一个可上网的服务网执行：
./logstash-plugin install logstash-filter-multiline
./logstash-plugin prepare-offline-pack --overwrite --output logstash-filter-multiline.zip logstash-filter-multiline

## 将包logstash-filter-multiline.zip拷贝到离线的logstash服务器/data/soft/logstash-8.11.2/bin目录下，执行安装命令
./logstash-plugin install file:///data/soft/logstash-8.11.2/bin/logstash-filter-multiline.zip

2、logstash-sample.conf配置

filter {
  multiline {
    pattern => "^\s"
    what => "previous"
  }
....
}