logstash add field to metadata
able carry max