gistfile1.txt

hello=world&fizz=&bar&test=1234
{
  "message"    => "hello=world&fizz=&bar&test=1234",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:16:04.372Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local",
  "hello"      => "world",
  "test"       => "1234"
}

% bin/logstash -e 'filter { kv { source => "message" target => fun field_split => "&" } }'
Using milestone 2 filter plugin 'kv'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.1.dev/plugin-milestones {:level=>:warn}
foo=
{
  "message"    => "foo=",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:18:13.769Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local"
}
bar=baz
{
  "message"    => "bar=baz",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:18:16.201Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local",
  "fun"        => {
    "bar" => "baz"
  }
}```

% bin/logstash -e 'filter { kv { source => "message" target => fun field_split => "&" } }'
Using milestone 2 filter plugin 'kv'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.1.dev/plugin-milestones {:level=>:warn}
foo=
{
  "message"    => "foo=",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:18:13.769Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local"
}
bar=baz
{
  "message"    => "bar=baz",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:18:16.201Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local",
  "fun"        => {
    "bar" => "baz"
  }
}```

% bin/logstash -e 'filter { kv { source => "message" target => fun field_split => "&" } }'
Using milestone 2 filter plugin 'kv'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.1.dev/plugin-milestones {:level=>:warn}
foo=
{
  "message"    => "foo=",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:18:13.769Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local"
}
bar=baz
{
  "message"    => "bar=baz",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:18:16.201Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local",
  "fun"        => {
    "bar" => "baz"
  }
}```

% bin/logstash -e 'filter { kv { source => "message" target => fun field_split => "&" } }'
Using milestone 2 filter plugin 'kv'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.1.dev/plugin-milestones {:level=>:warn}
foo=
{
  "message"    => "foo=",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:18:13.769Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local"
}
bar=baz
{
  "message"    => "bar=baz",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:18:16.201Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local",
  "fun"        => {
    "bar" => "baz"
  }
}```

% bin/logstash -e 'filter { kv { source => "message" target => message field_split => "&" } }'
Using milestone 2 filter plugin 'kv'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.1.dev/plugin-milestones {:level=>:warn}
foo=bar
{
  "message"    => {
    "foo" => "bar"
  },
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:19:21.521Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local"
}
foo=
{
  "message"    => "foo=",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:19:22.321Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local"
}

% bin/logstash -e 'filter { kv { source => "message" target => message field_split => "&" } }'
Using milestone 2 filter plugin 'kv'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.1.dev/plugin-milestones {:level=>:warn}
foo=bar
{
  "message"    => {
    "foo" => "bar"
  },
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:19:21.521Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local"
}
foo=
{
  "message"    => "foo=",
  "@version"   => "1",
  "@timestamp" => "2014-04-29T21:19:22.321Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local"
}