If that is actually an example of what you are trying to parse then it does not have a [message] field, it has a [_source][message] field. Normally I would assume that you are showing an example of the document in elasticsearch that results, but in that case the filter you show would parse it, so it suggests that assumption is incorrect.
Please clarify your question.