Move my suggestion to before the json filter:
filter {
mutate {
gsub => [ "message", "}{", "}
{" ]
}
split {
field => "message"
}
json {
source => "message"
}
split {
field => "[logEvents]"
}
mutate {
add_field => {
"log-event-id" => "%{[logEvents][id]}"
"log-event-message" => "%{[logEvents][message]}"
"log-event-time" => "%{[logEvents][timestamp]}"
}
remove_field => [
"[message]",
"[host]",
"[path]",
"[logEvents]",
"[subscriptionFilters]",
"[messageType]"
]
}
}