expander.rb

# encoding: utf-8
require "logstash/filters/base"
require "logstash/namespace"

class LogStash::Filters::Expander < LogStash::Filters::Base

  config_name "expander"
  milestone 2
  
  config :field, :validate => :string, :default => "log_actions"

  public
  def register
    # Nothing to do
  end # def register

  public
  def filter(event)
    return if not event[@field]
    obj = event[@field]
    return if obj.length == 0
    @logger.debug("Running expander filter", :event => event)
    obj.each do |item|
        next if item.empty?
        new_event = event.clone
        if item.is_a? Hash
            item.each{|k,v|
                new_event[k] = v
            }
        end
        new_event.remove(@field)
        @logger.debug("convert item to create new event", :item => item, :new_event => new_event)
        yield new_event
    end
    event.cancel
  end # def filter
end # class LogStash::Filters::Expander