Backport/metadata handling issue fixed in master

CHANGELOG.md

@@ -0,0 +1,2 @@
+## 1.1.0
+ - Fix metadata handling, fixes #19 and #22

Gemfile

@@ -1,2 +1,2 @@
 source 'https://rubygems.org'
-gemspec
+gemspec

lib/logstash/filters/multiline.rb

@@ -228,8 +228,10 @@ def previous_filter!(event, match)
       # this line is not part of the previous event if we have a pending event, it's done, send it.
       # put the current event into pending
       unless pending.empty?
-        tmp = event.to_hash
-        event.overwrite(merge(pending))
+        tmp           = event.to_hash_with_metadata
+        merged_events = merge(pending)
+        event.overwrite(merged_events)
+        event["@metadata"] = merged_events["@metadata"] # Override does not copy the metadata
         pending.clear # avoid array creation
         pending << LogStash::Event.new(tmp)
       else
@@ -253,7 +255,9 @@ def next_filter!(event, match)
       # if we have something in pending, join it with this message and send it.
       # otherwise, this is a new message and not part of multiline, send it.
       unless pending.empty?
-        event.overwrite(merge(pending << event))
+        merged_events = merge(pending << event)
+        event.overwrite(merged_events)
+        event["@metadata"] = merged_events["@metadata"] # Override does not copy the metadata
         pending.clear
       end
     end # if match

logstash-filter-multiline.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-multiline'
-  s.version         = '1.0.0'
+  s.version         = '1.1.0'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "This filter will collapse multiline messages from a single source into one Logstash event."
   s.description     = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
   s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
 
   # Gem dependencies
-  s.add_runtime_dependency "logstash-core", '>= 1.4.0', '< 2.0.0'
+  s.add_runtime_dependency "logstash-core", '>= 1.4.0', '< 2.0.0.alpha0'
   s.add_runtime_dependency 'logstash-patterns-core'
   s.add_runtime_dependency 'logstash-filter-mutate'
   s.add_runtime_dependency 'jls-grok', '~> 0.11.0'

spec/filters/multiline_spec.rb

@@ -245,4 +245,47 @@
     end
   end
 
+
+  describe "keeps metadata fields after two consecutive non multline lines" do
+    config <<-CONFIG
+    filter {
+       mutate { add_field => { "[@metadata][index]" => "logstash-2015.11.19" } }
+       multiline {
+          pattern => "^%{NUMBER}"
+          what => "previous"
+      }
+       mutate { add_field => { "[@metadata][type]" => "foo" } }
+    }
+    CONFIG
+
+    sample ["line1", "line2"] do
+      expect(subject).to be_a(Array)
+      expect(subject[0]["@metadata"]).to include("index"=>"logstash-2015.11.19")
+      expect(subject[1]["@metadata"]).to include("index"=>"logstash-2015.11.19")
+      expect(subject[0]["@metadata"]).to include("type"=>"foo")
+      expect(subject[1]["@metadata"]).to include("type"=>"foo")
+    end
+  end
+
+  describe "keeps metadata fields after two consecutive non multline lines" do
+    config <<-CONFIG
+    filter {
+       mutate { add_field => { "[@metadata][index]" => "logstash-2015.11.19" } }
+       multiline {
+          pattern => "^%{NUMBER}"
+          what => "next"
+      }
+       mutate { add_field => { "[@metadata][type]" => "foo" } }
+    }
+    CONFIG
+
+    sample ["line1", "line2"] do
+      expect(subject).to be_a(Array)
+      expect(subject[0]["@metadata"]).to include("index"=>"logstash-2015.11.19")
+      expect(subject[1]["@metadata"]).to include("index"=>"logstash-2015.11.19")
+      expect(subject[0]["@metadata"]).to include("type"=>"foo")
+      expect(subject[1]["@metadata"]).to include("type"=>"foo")
+    end
+  end
+
 end