So you are trying to parse the request body with logstash?
as you can see it is json formatted query beginning from "{"query":{" with this you can grok it out and parse it as json. this qould be a bit much logic, but you can do it also like this:
if [field_with_query] =~ /credentials/ and [field_with_query] =~ /password/ {
#use a filter as you want like mutate to add tags or fields
}