Support for not splitting the original message added

Added split_original config param (default: true), when true - splits the original message to multiple lines by '\n'; when false - passes original message as is.
over_maximun_lines check changed from 'greater then' to 'greater or equal': setting max_lines = X actually produced message blocks of X+1 messages due to strict "greater than" sign.

Author: sxmichael

lib/logstash/codecs/multiline.rb

@@ -132,6 +132,9 @@ module LogStash module Codecs class Multiline < LogStash::Codecs::Base
   # auto_flush_interval. No default.  If unset, no auto_flush. Units: seconds
   config :auto_flush_interval, :validate => :number
 
+  # Whether to split original message to lines.
+  config :split_original, :validate => :boolean, :default => true
+
   public
 
   def register
@@ -188,7 +191,9 @@ def accept(listener)
 
   def decode(text, &block)
     text = @converter.convert(text)
-    text.split("\n").each do |line|
+
+    lines = @split_original ? text.split("\n") : [text]
+    lines.each do |line|
       match = @grok.match(line)
       @logger.debug("Multiline", :pattern => @pattern, :text => line,
                     :match => !match.nil?, :negate => @negate)
@@ -263,7 +268,7 @@ def do_previous(text, matched, &block)
   end
 
   def over_maximum_lines?
-    @buffer.size > @max_lines
+    @buffer.size >= @max_lines
   end
 
   def over_maximum_bytes?