gistfile1.txt

input {
    beats {
            port => "5245"
            tags => [ "activedirectory-stats" ]
    }
}
filter {
    json {
            source => "event"
    }
    ruby {
            code => "
                    keys = event.get(['windows']['perfmon']['metrics'])
                    puts keys
                    hash=keys.map { |key, value|
                            key.split('_').reverse.reduce(value) {
                                    |key_value, next_key| {
                                            next_key => key_value
                                    }
                            }
                    }
                    class Hash

                      def deep_merge(other_hash, &block)
                        dup.deep_merge!(other_hash, &block)
                      end

                      # Same as +deep_merge+, but modifies +self+.
                      def deep_merge!(other_hash, &block)
                        merge!(other_hash) do |key, this_val, other_val|
                          if this_val.is_a?(Hash) && other_val.is_a?(Hash)
                            this_val.deep_merge(other_val, &block)
                          elsif block_given?
                            block.call(key, this_val, other_val)
                          else
                            other_val
                          end
                        end
                      end
                    end

                    val = {}
                    hash.each do |x|
                      val = val.deep_merge(x)
                    end
                    event.set(['windows']['perfmon']['metrics'], val)
                    #puts event.to_json
            "
    }
}
output {
    stdout {
            codec => rubydebug { metadata => true }
    }
}