title: Filebeat multiline tag is not getting added for multiline event
body: <p><strong>What I have done:</strong></p>
  
  <p>I have enabled multiline pattern in filebeat.yml file:</p>
  
  <pre class="lang-yaml prettyprint-override"><code>  multiline.pattern: '^[[:space:]]+|^Caused by:'
    multiline.negate: false
    multiline.match: after
  </code></pre>
  
  <p>My sample log file contains multiline exceptions:</p>
  
  <pre class="lang-java prettyprint-override"><code>Exception in thread "main" java.lang.IllegalStateException: A book has a null property
         at com.example.myproject.Author.getBookIds(Author.java:38)
         at com.example.myproject.Bootstrap.main(Bootstrap.java:14)
  Caused by: java.lang.NullPointerException
         at com.example.myproject.Book.getId(Book.java:22)
         at com.example.myproject.Author.getBookIds(Author.java:35)
         ... 1 more
  Exception in thread "main" java.lang.NullPointerException
          at com.example.myproject.Book.getTitle(Book.java:16)
          at com.example.myproject.Author.getBookTitles(Author.java:25)
          at com.example.myproject.Bootstrap.main(Bootstrap.java:14)
  </code></pre>
  
  <p>From filebeat logs I can see that these multiline exceptions are getting parsed properly:</p>
  
  <pre class="lang-sh prettyprint-override"><code>2017-05-15T08:21:36-07:00 DBG  Publish: {
    "@timestamp": "2017-05-15T15:21:31.768Z",
    "beat": {
      "hostname": "WIN-UV5OA3SO3LF",
      "name": "WIN-UV5OA3SO3LF",
      "version": "5.2.0"
    },
    "input_type": "log",
    "message": "Exception in thread \"main\" java.lang.IllegalStateException: A book has a null property\n       at com.example.myproject.Author.getBookIds(Author.java:38)\n       at com.example.myproject.Bootstrap.main(Bootstrap.java:14)\nCaused by: java.lang.NullPointerException\n       at com.example.myproject.Book.getId(Book.java:22)\n       at com.example.myproject.Author.getBookIds(Author.java:35)\n       ... 1 more",
    "offset": 409,
    "source": "C:\\Filebeat\\test\\testLog.txt",
    "type": "log"
  }
  
  2017-05-15T08:21:41-07:00 DBG  Publish: {
    "@timestamp": "2017-05-15T15:21:31.768Z",
    "beat": {
      "hostname": "WIN-UV5OA3SO3LF",
      "name": "WIN-UV5OA3SO3LF",
      "version": "5.2.0"
    },
    "input_type": "log",
    "message": "Exception in thread \"main\" java.lang.NullPointerException\n        at com.example.myproject.Book.getTitle(Book.java:16)\n        at com.example.myproject.Author.getBookTitles(Author.java:25)\n        at com.example.myproject.Bootstrap.main(Bootstrap.java:14)",
    "offset": 669,
    "source": "C:\\Filebeat\\test\\testLog.txt",
    "type": "log"
  }
  </code></pre>
  
  <p><strong>Problem:</strong></p>
  
  <ul>
  <li>Multiline events parsed by filebeat is not getting tagged as
  multiline.</li>
  <li>Due to this my grok filter on logstash is not able to treat it accordingly</li>
  </ul>
  
  <pre>
  <code>
  
      if "multiline" in [tags] {
        grok {
          match => ["message", "%{JAVASTACKTRACEPART}"]
        }
      }
  
  </code>
  </pre>
  
  <p>Any pointers will be appreciated!</p>