原始输入日志文件每行日志格式如下，json 数组格式的：
[{“a”:1},{“a”:2}]

要求拆分成2行事件，在ES中保存两个文档
{“a”:1}
{“a”:2}

本来以为挺麻烦，原来 input -> codec => json 直接支持解析这种格式，真愚昧啊

    file {
        type => "test"
        path => "/home/jfy/tmp/test.txt"
        sincedb_path => "/home/jfy/soft/logstash-2.0.0/test.access"
        start_position => "beginning"
        codec => json
    }

codec json:
This codec may be used to decode (via inputs) and encode (via outputs) full JSON messages. If the data being sent is a JSON array at its root multiple events will be created (one per element).