How to split a JSON array inside an object
The following code should do what you want and return one event for each method:
filter { if !("splitted_beans" in [tags]) { json { source => "message" } split { field => "bean" add_tag => ["splitted_beans"] } } if ( "splitted_beans" in [tags] and [bean][method] ) { split { field => "bean[method]" } }}The second condition checks if the first method was successful and if a method exists inside your bean. So it works for beans without methods as well.