Since I use a managed service to run log stash, I used the debug codec in the file output.
None of the messages contain just %{host} %{message}
It seems to be only in the s3 output.
the content of the messages is confidential, so is it possible to dm you?