change logstash to new event struct