Syntax for configuring filter is unnatural

[joshuaspence]

The syntax for configuring the mutate filter is very strange to me. I suspect that it is old behavior that has simply been carried forward in order to prevent breaking backwards compatibility (see logstash-plugins/logstash-filter-date#71).

Basically, I would expect to configure the filter like this:

mutate {
  gsub => {
    "field_one" => { 
      "search" => "replace"
    }
    "field_two" => {
      "search" => "replace"
    }
  }
}

Instead, I must do this:

mutate {
  gsub => [
    "field_one", "search", "replace",
    "field_two", "search", "replace"
  ]
}