Add line number counter for multiline

CHANGELOG.asciidoc

@@ -824,6 +824,11 @@ https://github.com/elastic/beats/compare/v5.2.0...v5.2.1[View commits]
 *Packetbeat*
 
 - Fix error in the NFS sample dashboard. {pull}3548[3548]
+- Add enabled config option to prospectors. {pull}3157[3157]
+- Add target option for decoded_json_field. {pull}3169[3169]
+- Add the `pipeline` config option at the prospector level, for configuring the Ingest Node pipeline ID. {pull}3433[3433]
+- Update regular expressions used for matching file names or lines (multiline, include/exclude functionality) to new matchers improving performance of simple string matches. {pull}3469[3469]
+- Add multiline line number to filebeat event {pull}2279[2279]
 
 *Winlogbeat*
 

filebeat/_meta/fields.common.yml

@@ -41,3 +41,8 @@
     - name: fileset.name
       description: >
         The Filebeat fileset that generated this event.
+
+    - name: multiline.lines
+      type: long
+      description: >
+        This is set in case of a multiline event and contains the number of lines that the multiline event consists of.

filebeat/docs/fields.asciidoc

@@ -959,6 +959,14 @@ The Filebeat module that generated this event.
 The Filebeat fileset that generated this event.
 
 
+[float]
+=== `multiline.lines`
+
+type: long
+
+This is set in case of a multiline event and contains the number of lines that the multiline event consists of.
+
+
 [[exported-fields-mysql]]
 == MySQL fields
 

filebeat/harvester/reader/multiline.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/elastic/beats/libbeat/common"
 	"github.com/elastic/beats/libbeat/common/match"
 	"github.com/elastic/beats/libbeat/logp"
 )
@@ -248,6 +249,12 @@ func (mlr *Multiline) clear() {
 
 // finalize writes the existing content into the returned message and resets all reader variables.
 func (mlr *Multiline) finalize() Message {
+
+	mlr.message.AddFields(common.MapStr{
+		"multiline": common.MapStr{
+			"lines": mlr.numLines,
+		},
+	})
 	// Copy message from existing content
 	msg := mlr.message
 	mlr.clear()

filebeat/tests/system/test_multiline.py

@@ -352,3 +352,36 @@ def test_invalid_config(self):
         self.wait_until(lambda: self.log_contains("missing required field accessing") == 1)
 
         proc.check_kill_and_wait(exit_code=1)
+
+    def test_multiline_lines(self):
+        """
+        Test if multiline line counter is added
+        """
+        self.render_config_template(
+            path=os.path.abspath(self.working_dir) + "/log/*",
+            multiline=True,
+            pattern="^\[",
+            negate="true",
+            match="after",
+            close_timeout="1s",
+        )
+
+        os.mkdir(self.working_dir + "/log/")
+
+        testfile = self.working_dir + "/log/test.log"
+
+        with open(testfile, 'w', 0) as file:
+            file.write("[2015] hello world\n")
+            file.write("  First Line\n")
+            file.write("  Second Line\n")
+
+        filebeat = self.start_beat()
+
+        self.wait_until(
+            lambda: self.output_has(lines=1),
+            max_timeout=10)
+
+        filebeat.check_kill_and_wait()
+
+        output = self.read_output_json()
+        output[0]["multiline"]["lines"] = 3