title: Logstash multiline codec ignore last event / line
body: <p>Logstash multiline codec ignore my last event (line) until send next package of logs.</p>
  
  <p>My logstash.conf:</p>
  
  <pre><code>input {
      }
      http {
          port =&gt; "5001"
          codec =&gt; multiline {
              pattern =&gt; "^\[%{TIMESTAMP_ISO8601}\]"
              negate =&gt; true
              what =&gt; previous
              auto_flush_interval =&gt; 15
          }
      }
  }
  
  filter{
      grok {
          match =&gt; { "message" =&gt; "(?m)\[%{TIMESTAMP_ISO8601:timestamp}\]\s\&lt;%{LOGLEVEL:log-level}\&gt;\s\[%{WORD:component}\]\s%{GREEDYDATA:log-message}" 
      }
  }
  
  output {
      elasticsearch {
          hosts =&gt; "elasticsearch:9200"
          index =&gt; "%{+YYYY-MM-dd}"
      }
  }
  </code></pre>
  
  <p>Moreover solution with <strong>auto_flush_interval</strong> don't work.</p>
  
  <p><strong>For example:</strong></p>
  
  <p><strong>input</strong> using Postman:</p>
  
  <blockquote>
    <p>[2017-07-11 22:32:12.345]  [KCU] Component initializing
    Exception in thread "main" java.lang.NullPointerException
            at com.example.myproject.Book.getTitle(Book.java:16)
    [2017-07-11 22:32:16.345]  [KCU] Return with status 1</p>
  </blockquote>
  
  <p><strong>output</strong> - only one event (should be two):</p>
  
  <blockquote>
    <p>[2017-07-11 22:32:12.345]  [KCU] Component initializing
    Exception in thread "main" java.lang.NullPointerException
            at com.example.myproject.Book.getTitle(Book.java:16)</p>
  </blockquote>
  
  <p>I need this last line.</p>
  
  <p><strong>Question:</strong>
  Am I doing something wrong or there are problems with multiline codec? - How to fix this?</p>