Those example outputs are being parsed in the "Operator App Mixins" elseif. The first grok in that branch does not match, because it is a multiline pattern being matched against a single line, so the second grok is called and converts message into an array.