If N>1 consecutive events happen consecutive, the last one will loss metadata

[purbon]

With a configuration like:

 filter {
       mutate { add_field => { "[@metadata][index]" => "logstash-2015.11.19" } }
       multiline {
          pattern => "^%{NUMBER}"
          what => "previous"
      }
    }

it N>1 events happen consecutive and are not match with the pattern, the last one will loss their metadata previous to the multline event. So in this example the metadata index field. This happen because in the previous filter metadata is not respected.

This does not happen in the case of using what => "next"

Related to #19

[owulff]

+1