I used logstash gelf plugin from port_udp to collect php log, if there is [‘id’ => $id] like structure in log, the key value pair will become a separate field ctxt_id in logstash and make meesage field not complete like below shows.