title: have a grok filter create nested fields as a result
body: <p>I have a drupal watchdog syslog file that I want to parse into essentially two nested fields, the syslog part and the message part so that I get this result</p>
  
  <pre><code>syslogpart: {
    timestamp: "",
    host: "",
    ...
  },
  messagepart:{
    parsedfield1: "",
    parsedfield2: "",
    ...
  }
  </code></pre>
  
  <p>I tried making a custom pattern that looks like this:</p>
  
  <p><code>DRUPALSYSLOG (%{SYSLOGTIMESTAMP:date} %{SYSLOGHOST:logsource} %{WORD:program}: %{URL:domain}\|%{EPOCH:epoch}\|%{WORD:instigator}\|%{IP:ip}\|%{URL:referrer}\|%{URL:request}\|(?&lt;user_id&gt;\d+)\|\|)</code></p>
  
  <p>and then run <code>match =&gt; ['message', '%{DRUPALSYSLOG:drupal}'}</code></p>
  
  <p>but I don't get a nested response, I get a textblock <code>drupal: "ALL THE MATCHING FIELDS IN ONE STRING"</code> and then all the matches separately as well but not nested under drupal but rather on the same level.</p>