[DOC] Improve/highlight differences in multiline usage on log vs filestream inputs

[lucabelluccini]

Describe the enhancement:

1. In the documentation page of filestream input for Filebeat the types of supported parsers (multiline, ndjson, container) are documented with a syntax which might be confusing. See https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-input-filestream.html#_parsers

Only the examples allow to understand their hierarchy:

This is user friendly and difficult to spot especially when scrolling over the page and we only see 1/2 options per scroll.

We should probably create sub-sections.

2. In the Multiline examples page, we might put an INFO/WARN box to suggest users that the multiline requires parsers for filestream input.

Probably the best place would be close to:

You can specify the following options in the filebeat.inputs section of the filebeat.yml config file to control how Filebeat deals with messages that span multiple lines.

Describe a specific use case for the enhancement or feature:

There are several references of users who expected multiline to be a drop-in replacement between log to filestream input: https://github.com/elastic/beats/issues/29361

Also Filebeat doesn't warn the user of an "invalid" configuration. It gets ignored but the user is not warned about it.

[elasticmachine]

Pinging @elastic/obs-docs (Team:Docs)

[zez3]

today would be a good day for this documentation enhancement, I have to dig through multiple PRs to find out what should be basic documentation

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!