Parsing nested key/value pairs with kv

Elastic Stack Logstash
1

I'm trying to parse a log file that is composed of key/value pairs separated by '='. The problem I have is that some of the keys need to be interpreted as nested objects. For example a log line might look like this:

11/02/2015 09:51:59 key1=val_1 key2=val_2 object1.field1=val_11 object1.field2=val_12 key3=val_3 ....

I do not know apriori all the possible keys or fields. But there is a limited set of objects. The order of appearance on a line is also unknown. The kv filter creates field names like "object1.field1". Later I want to use the elasticsearch output plug to index the log messages and I need it as an nested field within the document, e.g.

{
  "key1": "val_1",
  "object1": { 
      "field1": "val_11", 
      "field2": "val_12"
  }
  "key2": "val_2",
  "key3": "val_3"
}

How can parse these into nested objects?

2

Did you ever figure out an efficient way to do this?
I am currently thinking of using grok to parse out the object.submessage pairs and then using kv to parse the key value pairs in the submessage and using target to send them up to the object, instead of rootlevel

3

Basically, I'm using kv include_keys with object.fieldX values. Then I use 'rename': "Object.fieldX" => " [Object][fieldX]" to put it in an actual object. I'm lucky since I know all the object <=> field pairs that I care about. There might be others, but they are unimportant to me. I still don't know how to capture them all.