yes I know that. But maybe a good idea is to implement such kind of functionality (properly) directly on the codec layer.
There is a problem with the codec itself cause some fields like "cef_ext.whatever" are splited correctly. I have noticed this problem with for ex "ad.arcSightEventPath" field.