Expected event format
[{key1:value1},{key2:value2}]
Basically zipkin wanted to consume it from elasticsearch and list is what it requires.
Here is a similar discussion - Logstash Filter Json To Array of Json - #6 by Badger but in my case output is elasticsearch I don't think I can use codec => plain { format => "[ %{[@metadata][string]}