title: Logstash - how do I split an array using the split filter without a target?
body: <p>I'm trying to split a JSON array into multiple events. Here's a sample input:</p>
  
  <pre><code>{"results" : [{"id": "a1", "name": "hello"}, {"id": "a2", "name": "logstash"}]}
  </code></pre>
  
  <p>Here's my filter and output config:</p>
  
  <pre><code>filter {
    split {
      field =&gt; "results"
    }
  }
  stdout { 
    codec =&gt; "rubydebug"
  }
  </code></pre>
  
  <p>This produces 2 events, one for each of the JSONs in the array. And it's close to what I'm looking for:</p>
  
  <pre><code>{                                              
         "results" =&gt; {                          
            "id" =&gt; "a1",                        
          "name" =&gt; "hello"                      
      },                                         
        "@version" =&gt; "1",                       
      "@timestamp" =&gt; "2015-05-30T18:33:21.527Z",
            "host" =&gt; "laptop",                                      
  }                                              
  {                                              
         "results" =&gt; {                          
            "id" =&gt; "a2",                        
          "name" =&gt; "logstash"                   
      },                                         
        "@version" =&gt; "1",                       
      "@timestamp" =&gt; "2015-05-30T18:33:21.527Z",
            "host" =&gt; "laptop",                                   
  }
  </code></pre>
  
  <p>The problem is the nested "results" part. "results" being the default value for the target parameter. 
  Is there a way to use the split filter without producing the nested JSON, and get something like this:</p>
  
  <pre><code>{                                                                     
            "id" =&gt; "a1",                        
          "name" =&gt; "hello"                      
        "@version" =&gt; "1",                       
      "@timestamp" =&gt; "2015-05-30T18:33:21.527Z",
            "host" =&gt; "laptop",                                      
  }                                              
  {                                              
            "id" =&gt; "a2",                        
          "name" =&gt; "logstash"                   
        "@version" =&gt; "1",                       
      "@timestamp" =&gt; "2015-05-30T18:33:21.527Z",
            "host" =&gt; "laptop",                                   
  }
  </code></pre>
  
  <p>The purpose is to feed this to the ElasticSearch output with each event being a document with document_id => "id". Any good solutions are welcomed!</p>