this assumes that grok filter has set flapjack_entity & flapjack_check to array with single values
howether if you use singles => true in grok filter those will be set just to string. So code should check if those two are Array or String