add splunk attributes and rewind logstash conf template