this is a recursive function that assembles nested fields into new flat fields separated by dashes and replaces any underscores in the field names with dashes.  since, as i understand it, the typical clojure / riemann convention is to use dashes over underscores.  someone please correct me if i'm wrong.  if this convention is important to maintain i figured it'd be better to do it in the plugin than in the logstash config.  i'm more than happy to make the changes you've suggested.

if performance is an issue i wouldn't put up a fight over removing the regex substitution all together.  since i'm still in POC mode with logstash / riemann integration, i've not had a chance to load test these changes and can't speak to it's possible impact.