Well, the decode_json_fields processor actually works great for the vaild JSON log entries (the last 2 in the example above).
My concern are the error messages when a Non-JSON log entry is processed.
The question is, whether decode_json_fields respects the when condition, at all?