logstash: hadoop: sytax fix #2

tested with https://grokdebug.herokuapp.com/

Change-Id: I63e2c2e22bbd22c8204d85c6cc1d2d90b5147043