You see this is what the filebeat is sending the logs to kafka consumer
{"@timestamp":"2026-01-16T04:20:09.458Z","@metadata":{"beat":"filebeat","type":"_doc","version":"9.2.3"},"agent":{"type":"filebeat","version":"9.2.3","ephemeral_id":"be38002b-8b78-40e0-9e48-395ad9086690","id":"5dcaaa64-6ca7-4198-bd71-b13eba561256","name":"DESKTOP-SDAFJ3S"},"ecs":{"version":"8.0.0"},"log":{"offset":1470166,"file":{"idxlo":"55530","vol":"1384174712","fingerprint":"593572ca026fe18e31e7d29b325158dac06ee4cbd41e3bbdf2df098d69e0c1d0","path":"C:\\logs\\isync.log","idxhi":"5636096"}},"message":"{\"Time\":\"2026-01-16 09:50:01,897\", \"Level\":\"INFO\", \"File\":\"webapi.py\", \"Line\":\"489\", \"EventName\":\"UploadFileBackend\", \"IP\":\"127.0.0.1\", \"UserID\":\"twowaysync.gmail.com\", \"DepartmentName\":\"iSyncInt\", \"RequestBody\":\"{'Flag': 0, 'GlobalSHAFlag': 'None', 'FolderDocId': '69687cd29eb1bb08b4510b8c', 'FileName': 'send-ss-9.txt', 'FileDescription': 'desc1', 'FileType': 'txt', 'ContentDisposition': 'attachment;filename=send-ss-9.txt', 'ContentType': 'application/octet-stream', 'FileSize': 3096, 'FileSHA': '5a08ccaeb698d8d39d995b92871542d85456fabeedfc6e7488879207617b7e06', 'Classification': '', 'DeviceType': 'web', 'Sync': 'True', 'DeviceId': 'DEVICEID1'}\", \"Result\":\"{\"msg\":\"File Uploaded Successfully\",\"output\":{\"spaceLeftInBytes\":10730536520,\"spaceUsedInBytes\":6881720},\"status\":\"SUCCESS\",\"statuscode\":200}","input":{"type":"filestream"},"kafka_topic":"isync-web-logs","host":{"name":"desktop-sdafj3s","mac":["00-15-5D-4E-25-D6","00-15-5D-E9-BF-5C","00-42-38-11-17-8C","00-42-38-11-17-8D","00-50-56-C0-00-01","00-50-56-C0-00-08","02-42-38-11-17-8C","08-92-04-3F-04-08"],"hostname":"DESKTOP-SDAFJ3S","architecture":"x86_64","os":{"family":"windows","name":"Windows 10 Pro","kernel":"10.0.19041.6807 (WinBuild.160101.0800)","build":"19045.6809","type":"windows","platform":"windows","version":"10.0"},"id":"ef07b92c-8e40-48dd-925a-b4edfc496a83","ip":["fe80::8a27:6c6:ba20:532","169.254.251.159","fe80::c48:4289:9fe3:3f1","172.22.64.1","fe80::62:52eb:62c3:1bd0","172.31.112.1","fe80::453d:40ba:706c:79f7","169.254.149.247","fe80::53e2:5ba0:9512:30ee","169.254.154.175","fe80::73d9:8fda:df0d:3fad","192.168.170.1","fe80::869:b850:552:a59d","192.168.40.1","2405:201:600e:7907:c34c:524b:f84a:8c38","2405:201:600e:7907:7dcc:42e0:da87:f91d","fe80::344a:6273:1490:d11f","192.168.29.133"]}}

Now I wanted is that if I can normalize this "message" field something like this.

{"message":

{
  "Time": "2026-01-16 09:12:08,081",
  "Level": "INFO",
  "File": "webapi.py",
  "Line": "489",
  "EventName": "UploadFileBackend",
  "IP": "127.0.0.1",
  "UserID": "twowaysync.gmail.com",
  "DepartmentName": "iSyncInt",
  "RequestBody": {
    "Flag": 0,
    "GlobalSHAFlag": "None",
    "FolderDocId": "6968753e9eb1bb08b4510b86",
    "FileName": "send-ss-1.txt",
    "FileDescription": "desc1",
    "FileType": "txt",
    "ContentDisposition": "attachment;filename=send-ss-1.txt",
    "ContentType": "application/octet-stream",
    "FileSize": 91,
    "FileSHA": "35fea3cb30da4f4f9053ac6569d387ec9f46b864137062c6ab5df73c12c82a26",
    "Classification": "",
    "DeviceType": "web",
    "Sync": true,
    "DeviceId": "DEVICEID1"
  },
  "Result": {
    "msg": "File Uploaded Successfully",
    "output": {
      "spaceLeftInBytes": 10730556935,
      "spaceUsedInBytes": 6861305
    },
    "status": "SUCCESS",
    "statuscode": 200
  }
}

}

How can I achieve that level of filtering in the filebeat