Replace values with predefined mapping with ELK