I think the conditional is wrong, the fields are not in the shape that you are expecting.
That is why I asked you to post output from stdout.
e.g. Something like:
{
"log_event" => {
"id" => "rtwert",
"bank" => "yes",
"proc" => nil,
"count" => "5",
"session" => "****",
},
"@version" => "1",
"host" => "Elastics-MacBook-Pro.local",
"message" => "blah bla blah",
"sequence" => 0,
"@timestamp" => 2019-02-05T11:31:45.347Z
}