logstash:提供整个文件并使用换行符拆分来创建新事件

我有以下logstash配置,用于从kafka读取类似系统日志的消息:

input {
    kafka {
        bootstrap_servers => "172.24.0.3:9092"
        topics => ["test"]
    }
}
filter {
    grok {
        match => { "message" => "%{SYSLOGTIMESTAMP}" }
    }
}
output {
    stdout { codec => rubydebug }
}

因此,当在logstash输入处发送syslog行时,在stdout处生成以下消息:

来自卡夫卡

r = p1.send('test', b'Jul 16 09:07:47 ubuntu user: test500')

标准输出

{
       "message" => "Jul 16 09:07:47 ubuntu user: test500",
      "@version" => "1",
    "@timestamp" => 2018-07-16T12:29:57.854Z,
          "host" => "6d87dde4c74e"
}

现在,我想添加多行 \n 每行末尾的字符和logstash将输入处理为两条分开的消息,以便logstash stdout类似于以下示例:

同一条消息中来自卡夫卡的多行

r = p1.send('test', b'Jul 16 09:07:47 ubuntu user: test501\nJul 16 09:07:47 ubuntu user: test502')

所需标准输出

{
       "message" => "Jul 16 09:07:47 ubuntu user: test501",
      "@version" => "1",
    "@timestamp" => 2018-07-16T12:29:57.854Z,
          "host" => "6d87dde4c74e"
}
{
       "message" => "Jul 16 09:07:47 ubuntu user: test502",
      "@version" => "1",
    "@timestamp" => 2018-07-16T12:29:57.854Z,
          "host" => "6d87dde4c74e"
}

有没有什么想法,如何在原木上实现这种行为?