- add a tag for events that have multiple lines (keeps backwards compat

to the older multiline filter)
- add tests to cover this behavior.

lib/logstash/codecs/multiline.rb

@@ -94,6 +94,10 @@ class LogStash::Codecs::Multiline < LogStash::Codecs::Base
   # This only affects "plain" format logs since json is UTF-8 already.
   config :charset, :validate => ::Encoding.name_list, :default => "UTF-8"
 
+  # Tag multiline events with a given tag. This tag will only be added
+  # to events that actually have multiple lines in them.
+  config :multiline_tag, :validate => :string, :default => "multiline"
+
   public
   def register
     require "grok-pure" # rubygem 'jls-grok'
@@ -156,7 +160,11 @@ class LogStash::Codecs::Multiline < LogStash::Codecs::Base
 
   def flush(&block)
     if @buffer.any?
-      yield LogStash::Event.new("@timestamp" => @time, "message" => @buffer.join("\n"))
+      event = LogStash::Event.new("@timestamp" => @time, "message" => @buffer.join("\n"))
+      # Tag multiline events
+      event.tag @multiline_tag if @multiline_tag && @buffer.size > 1
+
+      yield event
       @buffer = []
     end
   end

spec/codecs/multiline.rb

@@ -16,7 +16,24 @@ describe LogStash::Codecs::Multiline do
       codec.flush { |e| events << e }
       insist { events.size } == 2
       insist { events[0]["message"] } == "hello world\n   second line"
+      insist { events[0]["tags"] }.include?("multiline")
       insist { events[1]["message"] } == "another first line"
+      insist { events[1]["tags"] }.nil?
+    end
+
+    it "should allow custom tag added to multiline events" do
+      codec = LogStash::Codecs::Multiline.new("pattern" => "^\\s", "what" => "previous", "multiline_tag" => "hurray" )
+      lines = [ "hello world", "   second line", "another first line" ]
+      events = []
+      lines.each do |line|
+        codec.decode(line) do |event|
+          events << event
+        end
+      end
+      codec.flush { |e| events << e }
+      insist { events.size } == 2
+      insist { events[0]["tags"] }.include?("hurray")
+      insist { events[1]["tags"] }.nil?
     end
 
     it "should allow grok patterns to be used" do