Merge pull request elastic#802 from fotonauts/LOGSTASH-1634

Logstash 1634
Thanks for making Logstash more awesome! :)

In the future we will be changing from describing any field as "nested" and instead just refer to all fields as "field references."

CHANGELOG

@@ -171,11 +171,11 @@
     superior search and analytics interface.
   - New feature: conditionals! You can now make "if this, then ..." decisions
     in your filters or outputs. See the docs here:
-    https://logstash.net/docs/latest/configuration#conditionals
+    http://logstash.net/docs/latest/configuration#conditionals
   - A new syntax exists for referencing fields (LOGSTASH-1153). This replaces
     the prior and undocumented syntax for field access (was 'foo.bar' and is
     now '[foo][bar]'). Learn more about this here:
-    https://logstash.net/docs/latest/configuration#fieldreferences
+    http://logstash.net/docs/latest/configuration#fieldreferences
   - A saner hash syntax in the logstash config is now supported. It uses the
     perl/ruby hash-rocket syntax: { "key" => "value", ... } (LOGSTASH-728)
   - ElasticSearch version 0.90.3 is included. (#486, Gang Chen)

docs/configuration.md

@@ -142,10 +142,11 @@ By way of example, let us suppose we have this event:
       }
     }
 
-The syntax to access fields is `[fieldname]`. If you are only referring to a
-top-level field, you can omit the `[]` and simply say `fieldname`. In the case
-of nested fields,
-like the "os" field above, you need the full path to that field: `[ua][os]`.
+- the syntax to access fields is `[fieldname]`.
+- if you are only referring to a **top-level field**, you can omit the `[]` and
+simply say `fieldname`.
+- in the case of **nested fields**, like the "os" field above, you need
+the full path to that field: `[ua][os]`.
 
 ## <a name="sprintf"></a>sprintf format
 

lib/logstash/filters/date.rb

@@ -78,6 +78,9 @@ class LogStash::Filters::Date < LogStash::Filters::Base
   #       }
   #     }
   #
+  # If your field is nested in your structure, you can use the nested
+  # syntax [foo][bar] to match its value. For more information, please refer to
+  # http://logstash.net/docs/latest/configuration#fieldreferences
   config :match, :validate => :array, :default => []
 
   # Store the matching timestamp into the given target field.  If not provided,

spec/filters/date.rb

@@ -218,7 +218,7 @@
     end
   end
 
-  describe "support deep field access" do
+  describe "support deep nested field access" do
     config <<-CONFIG
       filter { 
         date {
@@ -282,5 +282,4 @@
       insist { subject["@timestamp"].year } == Time.now.year
     end
   end
-
 end