Logstash filter issue