title: How to extract feature from the Elasticsearch _source to index
body: <p>I have used logstash,elasticsearch and kibana to collect logs.
  The log file is json which like this:</p>
  
  <pre><code>{"_id":{"$oid":"5540afc2cec7c68fc1248d78"},"agentId":"0000000BAB39A520","handler":"SUSIControl","sensorId":"/GPIO/GPIO00/Level","ts":{"$date":"2015-04-29T09:00:00.846Z"},"vHour":1}
  {"_id":{"$oid":"5540afc2cec7c68fc1248d79"},"agentId":"0000000BAB39A520","handler":"SUSIControl","sensorId":"/GPIO/GPIO00/Dir","ts":{"$date":"2015-04-29T09:00:00.846Z"},"vHour":0}
  </code></pre>
  
  <p>and the code I have used in logstash:</p>
  
  <pre><code>input {
    file {
      type =&gt; "log"
      path =&gt; ["/home/data/1/1.json"]        
      start_position =&gt; "beginning"
    }
  }
  
  filter {
      json{
          source =&gt; "message"   
       }
  }
  output {
    elasticsearch { embedded =&gt; true }
    stdout { codec =&gt; rubydebug }
  }
  </code></pre>
  
  <p>then the output in elasticsearch is :</p>
  
  <pre><code>{
  "_index": "logstash-2015.06.29",
  "_type": "log",
  "_id": "AU5AG7KahwyA2bfnpJO0",
  "_version": 1,
  "_score": 1,
  "_source": {
  "message": "{"_id":{"$oid":"5540afc2cec7c68fc1248d7c"},"agentId":"0000000BAB39A520","handler":"SUSIControl","sensorId":"/GPIO/GPIO05/Dir","ts":{"$date":"2015-04-29T09:00:00.846Z"},"vHour":1}",
  "@version": "1",
  "@timestamp": "2015-06-29T16:17:03.040Z",
  "type": "log",
  "host": "song-Lenovo-IdeaPad",
  "path": "/home/song/soft/data/1/Average.json",
  "_id": {
  "$oid": "5540afc2cec7c68fc1248d7c"
  },
  "agentId": "0000000BAB39A520",
  "handler": "SUSIControl",
  "sensorId": "/GPIO/GPIO05/Dir",
  "ts": {
  "$date": "2015-04-29T09:00:00.846Z"
  },
  "vHour": 1
  }
  }
  </code></pre>
  
  <p>But the information in the json file all in the _source not index 
  so that i can't use kibana to analysis them.</p>
  
  <p>the kibana shows that Analysis is not available for object fields.
  the _source is object fields</p>
  
  <p>how to solve this problem?</p>