majikthys/log4j2-logstash-jsonevent-layout — pull request #13 by rarruda (2014-09-17 11:34:33+00:00)
Title: Properties field should be a JSON hash, and not array of hashes.

This allows ElasticSearch to treat Properties as an Object, instead of Array when indexing.
Making easier to search/analyze, and optimize our schema according to pre-defined Property values.

As it is now for the Properties element:
"Properties":[ {"some_key":"some_value"},{"key_2":"value_2"} ]
But should be:
"Properties":{"some_key":"some_value","key_2":"value_2"}

ES Objects maps much better to this use case (logging) where Properties tend to be unique...
http://www.elasticsearch.org/guide/en/elasticsearch/reference/master/mapping-object-type.html
http://www.elasticsearch.org/guide/en/elasticsearch/reference/master/mapping-array-type.html