Thanks for the pointers. I've solved the problem:
filter {
json {
source => "message"
target => "wtfyo"
}
ruby {
code => "
event['wtfyo'].each do |key, value|
event.tag(key);
value.to_hash;
value.each do |key2, val2|
event[key2] = val2;
end
event.remove('wtfyo');
event.remove('message');
end
"
}
}