Could you post some informations?
- What version of Logstash?
- What version of Filebeat?
What's happen when you use "message" field?
In your filter block on json plugin you use "source_input" but I don't see this field in your log exemple. Where you defined this field?
In general, We used the message field with json as input like [source => "message"]. See in this document Source - Logstash Filter.
Other point about your json log, there is an invalid format on your Json in this section:
"reqHdr":{
"conn":"Keep-Alive",
}
There is a comma after the single value from reqHdr. I don't know if there might be a problem when trying to validate this json message.