Can i have the below data structure as an output from any of the output filters in logstash. What i'm able to achieve so far is to just have a single level of dictionary like,


"output": "xxx"
"name": "ccc"

but how can i have a dictionary inside a list as in the final output...I know that i'd have to write some custom filter for the same. But what i don't understand is it even possible to have the format of the output as below.

    "status-change": [
      {
        "event-time": {
          "perceived-severity": "",
          "alarm-text": "",
          "root-cause": ""
        }
      }


The final output when sent out from logstash should look this way.

{
  "id": "6fef093e-fa75-4e0b-afb7-4aa8dd5b8358",
  "client": {
    "name": "elastigirl1",
    "address": "10.199.0.0",
    "subscriptions": [
      "test"
    ],
    "version": "0.16.0",
    "timestamp": 1430345716
  },
  "check": {
    "alarm-id": "",
    "name": "kumoakshay",
    "is_cleared": "",
    "last-alarm-text": "",
    "last-alarm-handling-change": "",
    "output": "",
    "status": 2,
    "status-change": [
      {
        "event-time": {
          "perceived-severity": "",
          "alarm-text": "",
          "root-cause": ""
        }
      },
      {
        "event-time": {
          "perceived-severity": "",
          "alarm-text": "",
          "root-cause": ""
        }
      }
    ],
    "handler": "email",
    "description": "AP configuration update failed",
    "venue_name": "",
    "issued": 1430345734,
    "history": [
      "2"
    ]
  },
  "occurrences": 1,
  "action": "create"
}