Logstash Filter

Elastic Stack Logstash
2

This part is fine

    split { field => "[records]" }
    split { field => "[records][properties][flows]" }
    split { field => "[records][properties][flows][flows]" }
    split { field => "[records][properties][flows][flows][flowTuples]" }

That gets you records like

{
       "records" => {
           "resourceId" => "",
           "properties" => {
            "Version" => 2,
              "flows" => {
                 "rule" => "DefaultRule_AllowInternetOutBound",
                "flows" => {
                           "mac" => "000D3A0A6B1F",
                    "flowTuples" => "1614682747,192.168.200.4,104.211.232.185,36368,443,T,O,A,E,8,1553,1,74"
                }
            }
        },
             "category" => "NetworkSecurityGroupFlowEvent",
        "operationName" => "NetworkSecurityGroupFlowEvents",
           "macAddress" => "",
                 "time" => "2021-03-02T11:00:06.8483928Z",
             "systemId" => ""
    }
    ...
}

The problem is in your mutate filter. Filter operations are processed in a fixed order. coerce first, then rename etc. You can check the code to see the order of the common options. You will need to use multiple mutate options to force the order you want.