Maybe include something to filter out only those json logs

[PGTBoos]

I'm assuming your code would work if your only interested in those logs.
If one would like to log more, perhaps its better to filter out only those json files you want in the processor
something alike :

 When:
  contains:
    or:
      - fileset.name: "audit.log"
      - fileset.name: "flow.log"
      - fileset.name: "nextcloud.log"  
    and:
         # alter your logfilepath where above 3 logs can be found
      - log.file.path: "/data/nextcloud/" 

 continuing your processor code