- Add :hash coercion for config; used for add_field, like so:

config :add_field => :hash

  and in the config file:

    foo {
      add_field => ["key1", "value1", "key2", "value2"]
      add_field => ["key3", "value3"]
    }

lib/logstash/config/mixin.rb

@@ -178,7 +178,18 @@ module LogStash::Config::Mixin
         result = value.first
       elsif validator.is_a?(Symbol)
         # TODO(sissel): Factor this out into a coersion method?
+        # TODO(sissel): Document this stuff.
         case validator
+          when :hash
+            if value.size % 2 == 1
+              return false, "This field must contain an even number of items, got #{value.size}"
+            end
+            # Use Hash[] (works in 1.8.7, anyway) to coerce into a hash.
+            p "HASH HASH HASH"
+            p "HASH HASH HASH"
+            p "HASH HASH HASH"
+            p value
+            result = Hash[*value]
           when :string
             if value.size > 1 # only one value wanted
               return false, "Expected string, got #{value.inspect}"

lib/logstash/filters/base.rb

@@ -10,7 +10,7 @@ class LogStash::Filters::Base
   config_name "filter"
   config :type => :string
   config :add_tag => nil
-  config :add_field => nil
+  config :add_field => :hash
 
   public
   def initialize(params)
@@ -41,20 +41,19 @@ class LogStash::Filters::Base
   # matches the filter's conditions (right type, etc)
   private
   def filter_matched(event)
+    @logger.info "FILTER MATCHED"
+    @logger.info :addtag => @add_tag
+    @logger.info :addfield => @add_field
+
     if @add_tag
       @add_tag.each { |tag| event.tags << tag }
     end
     if @add_field
-      if @add_field.length % 2 != 0
-        @logger.warn("filter #{self.class}: add_field must be an even amount of fields [key1, val1, key2, val2, ...]")
-      else
-        combos = @add_field.length / 2
-        0.upto(combos - 1) do |i|
-          field, value = @add_field[2*i], @add_field[2*i+1]
-          event[field] ||= []
-          event[field] << value
-        end # 0.upto(combos)
-      end # if @add_field.length % 2
+      @add_field.each do |field, value|
+        @logger.info "Adding field: #{field} => #{event.sprintf(value)}"
+        event[field] ||= []
+        event[field] << event.sprintf(value)
+      end # @add_field.each
     end # if @add_field
   end # def filter_matched
 end # class LogStash::Filters::Base

lib/logstash/filters/grok.rb

@@ -51,7 +51,6 @@ class LogStash::Filters::Grok < LogStash::Filters::Base
     end
 
     if match
-      filter_matched(event)
       match.each_capture do |key, value|
         if key.include?(":")
           key = key.split(":")[1]
@@ -72,6 +71,7 @@ class LogStash::Filters::Grok < LogStash::Filters::Base
           event.fields[key] << value
         end
       end
+      filter_matched(event)
     else
       # Tag this event if we can't parse it. We can use this later to
       # reparse+reindex logs if we improve the patterns given .