Expanding a log Message to 2

[tastyfrankfurt]

Hey Team,

We have a use case currently in logstash that we wish vector to solve, currently we have OpenSearch sending alerts. When opensearch sends an alert it send 1 alert with all the instances where the alert occured in 1 message. We would like vector to solve this by being able to split this one alert into multiple alerts. The below is a source log example going to a target log example.
SOURCE LOG
{
"timestamp: "yyyymmdd hh:mm:ss",
"field1": "blah",
"field2": "blad",
"alerts": {
"alert1": "some strange string",
"alert2": "some other strange string"
}
}
TARGET LOGS
{
"timestamp: "yyyymmdd hh:mm:ss",
"field1": "blah",
"field2": "blad",
"alert": "some strange string"
}

{
"timestamp: "yyyymmdd hh:mm:ss",
"field1": "blah",
"field2": "blad",
"alert": "some other strange string"
}

[spencergilbert]

This example should help, and there is also an unnest function to help here as well.

It looks like your example log is more or less the same pattern as the example and something like . = parse_json!(.alerts) would work (with some additional work if you wanted to retain original fields).