fix logstash parsing