made
filter { if [detail][data][response][body] { ruby { code => " if event.get('[detail][data][response][body]').is_a? String event.set('[detail][data][response][body]', {'[detail][data][response][body][givenstring]' => event.get('[detail][data][response][body]')}) end" } } }
didnt work, again infinite restart