multiline_filter.conf

input {
    # Make a starting event, and 3 continuation events -- A second event MUST start before the previous one is pushed though the pipe.
    generator {
        type => "generated"
        lines => [
            "Testing1",
            "  Testing2",
            "  Testing3",
            "  Testing4",
            "Testing5"
         ]
        count => 1
    }
}

filter {
    multiline {
        pattern => "  "
        what => "previous"
    }
}

output {
    stdout { codec => rubydebug }
}