Merge remote branch 'origin/master'

etc/agent.conf

@@ -17,7 +17,7 @@ filter {
     add_tag => "test_tag1"
     add_tag => ["test_tag2", "test_tag3"]
     add_field => ["grok_filtered", "true"]
-    add_field => ["test_key", "test_value"]
+    add_field => ["test_key", "the pid is %{pid}"]
   }
 }
 

lib/logstash/config/mixin.rb

@@ -178,7 +178,14 @@ module LogStash::Config::Mixin
         result = value.first
       elsif validator.is_a?(Symbol)
         # TODO(sissel): Factor this out into a coersion method?
+        # TODO(sissel): Document this stuff.
         case validator
+          when :hash
+            if value.size % 2 == 1
+              return false, "This field must contain an even number of items, got #{value.size}"
+            end
+            # Use Hash[] (works in 1.8.7, anyway) to coerce into a hash.
+            result = Hash[*value]
           when :string
             if value.size > 1 # only one value wanted
               return false, "Expected string, got #{value.inspect}"

lib/logstash/filters/base.rb

@@ -10,7 +10,7 @@ class LogStash::Filters::Base
   config_name "filter"
   config :type => :string
   config :add_tag => nil
-  config :add_field => nil
+  config :add_field => :hash
 
   public
   def initialize(params)
@@ -45,16 +45,11 @@ class LogStash::Filters::Base
       @add_tag.each { |tag| event.tags << tag }
     end
     if @add_field
-      if @add_field.length % 2 != 0
-        @logger.warn("filter #{self.class}: add_field must be an even amount of fields [key1, val1, key2, val2, ...]")
-      else
-        combos = @add_field.length / 2
-        0.upto(combos - 1) do |i|
-          field, value = @add_field[2*i], @add_field[2*i+1]
+      @add_field.each do |field, value|
+        @logger.info "Adding field: #{field} => #{event.sprintf(value)}"
         event[field] ||= []
-          event[field] << value
-        end # 0.upto(combos)
-      end # if @add_field.length % 2
+        event[field] << event.sprintf(value)
+      end # @add_field.each
     end # if @add_field
   end # def filter_matched
 end # class LogStash::Filters::Base

lib/logstash/filters/grok.rb

@@ -51,7 +51,6 @@ class LogStash::Filters::Grok < LogStash::Filters::Base
     end
 
     if match
-      filter_matched(event)
       match.each_capture do |key, value|
         if key.include?(":")
           key = key.split(":")[1]
@@ -72,6 +71,7 @@ class LogStash::Filters::Grok < LogStash::Filters::Base
           event.fields[key] << value
         end
       end
+      filter_matched(event)
     else
       # Tag this event if we can't parse it. We can use this later to
       # reparse+reindex logs if we improve the patterns given .