title: Filebeat doesn't read full event if empty line is in between
body: <p>I currently try to read EVTX (windows event) files with Filebeat. This works so far, but of my almost 9.000 event entries only five aren't read. The problem here is the first line doesn't match my pattern (which might be because of the pattern itself) and the other four have empty lines in between.</p>
  
  <p>My current lines look like that:</p>
  
  <pre><code>"Test message which represents the first line of
  
  my current data
  block
  
  as shown here"; "Some value"; "More values"; "IDKFA"; "IDDQD"; "EndOfData"
  </code></pre>
  
  <p>What I did is using the multiline codec from Filebeat like this:</p>
  
  <pre><code>multiline.pattern: '^\".*EndOfData\"$'
  multiline.negate: true
  multiline.match: before
  </code></pre>
  
  <p>Every line ends with "EndOfData" at the end of the data block. 
  The problem I have is, that Filebeat creates a completely new entry for every data line which is not empty. Like this:</p>
  
  <p><strong>Entry #1:</strong></p>
  
  <pre><code>"Test message which represents the first line of
  </code></pre>
  
  <p><strong>Entry #2:</strong></p>
  
  <pre><code>my current data
  block
  </code></pre>
  
  <p><strong>Entry #3:</strong></p>
  
  <pre><code>as shown here"; "Some value"; "More values"; "IDKFA"; "IDDQD"; "EndOfData"
  </code></pre>
  
  <p>It really doesn't work and I don't know why. The only difference to other entries is, that there are no spaces in between the lines. If I try to "ignore" the lines with the exclude_lines command and the regex such as "^$" it doesn#t work either.</p>
  
  <p>Do you have any suggestions?</p>