logstash: Reduce filter worker count to 1

When running with multiple worker threads the multiline filter
occasionally becomes confused and merges multiple events together. This
can result in events that cannot be serialized for output to
Elasticsearch. Once this happens no events will be added to
Elasticsearch until the logstash service is restarted.

Change-Id: Iac2e0980bfce66f546b352a5350614bdd482160c

manifests/role/logstash.pp

@@ -36,7 +36,10 @@
 
     class { '::logstash':
        heap_memory_mb => 128,
-       filter_workers => 3,
+       # TODO: the multiline filter that is used in several places in the
+       # current configuration isn't thread safe and can cause crashes or
+       # garbled output when used with more than one thread worker.
+       filter_workers => 1,
     }
 
     class { '::logstash::input::udp2log':