How to parse mix json logs

If you require a different number of columns for different events then you could use a conditional to decide which csv filter to use. Something like

if [message] =~ /.*,.*,.*,.*,.*/
    csv {} # events with 5 fields
else if [message] =~ /.*,.*,.*,.*/
    csv {} # events with 4 fields
[...]