improve logstash parsing