From 03ba706635be926da59beb06915a3880a2a3d2a1 Mon Sep 17 00:00:00 2001
From: Jordan Sissel <jls@semicomplete.com>
Date: Sat, 20 Nov 2010 10:15:55 +0000
Subject: [PATCH] - Add tag 'multiline' if an event is successfully parsed as a
 multiline message.

---
 lib/logstash/filters/multiline.rb | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/logstash/filters/multiline.rb b/lib/logstash/filters/multiline.rb
index 958634439ee..dee19da111c 100644
--- a/lib/logstash/filters/multiline.rb
+++ b/lib/logstash/filters/multiline.rb
@@ -82,21 +82,22 @@ def register
         @logger.fatal(["Invalid pattern for multiline filter on type '#{type}'",
                       typeconfig, e])
       end
+
     end # @config.each
   end # def register
 
   def filter(event)
     return unless @types.member?(event.type)
     typeconfig = @types[event.type]
-    #@types[event.type].each do |key, value|
-    #puts "#{event.type}: " + typeconfig.inspect
     match = typeconfig["pattern"].match(event.message)
     key = [event.source, event.type]
     pending = @pending[key]
 
+    @logger.info(["Reg: ", typeconfig["pattern"], event.message, match])
     case typeconfig["what"]
     when "previous"
       if match
+        event.tags |= ["multiline"]
         # previous previous line is part of this event.
         # append it to the event and cancel it
         if pending
@@ -120,6 +121,7 @@ def filter(event)
       end # if/else match
     when "next"
       if match
+        event.tags |= ["multiline"]
         # this line is part of a multiline event, the next
         # line will be part, too, put it into pending.
         if pending