Ah, I'm so sorry for that, the log comes wrapper by quotes.
(I've edited my first post)
It's super annoying but I've to escape the last quote. And indeed you're right I get this message a lot.
Here is what a parsing returns from kibana (json view):
"message": "msg:\"[demo-xiaomi][CAM ][2018-04-26-16:32:42.041 1901064912] [INFO] JSEXTRA:{\\\"camera_id\\\": \\\"0\\\", \\\"user_id\\\": \\\"50:F1:4A:E4:99: F\\\", \\\"tag\\\": \\\"streaming_stopped\\\"}\" ",
"data_json": "{\\\"camera_id\\\": \\\"0\\\", \\\"user_id\\\": \\\"50:F1:4A:E4:99: F\\\", \\\"tag\\\": \\\"streaming_stopped\\\"}"
but this json isn't showing at the root of ES...