diff --git a/diagnostics/opensearch/logstash/logstash.conf b/diagnostics/opensearch/logstash/logstash.conf
index 41cd054..87a483a 100644
--- a/diagnostics/opensearch/logstash/logstash.conf
+++ b/diagnostics/opensearch/logstash/logstash.conf
@@ -4,6 +4,16 @@ input {
   }
 }
 
+filter {
+    json {
+        source => "message"
+        remove_field => ["message"]
+    }
+    split {
+        field => "records"
+    }
+}
+
 output {
     opensearch {
         hosts =>  ["${OPENSEARCH_HOST}:9200"]