Set logstash format on forward_to_es image