logstash/logstash — pull request #787 by 20goto10 (2013-11-19 21:00:31+00:00)
Title: JSON filter with ability to split arrays into separate JSON components

An update to the JSON filter which allows the user to specify an array_split key in the hash. The contents are split into multiple entries and yielded back for further processing.

This is useful when the log data contains multiple event entries as an array.

Sample config section-- in this scenario, log data was returned as a single row of JSON data under the hash key "message". "Message" contained only the "Records" field, pointing to more JSON presented as an array of hashes. This configuration will allow the user to separate those records back into individual events.

filter {
json {
source => "message"
array_split => "Records"
}
}