json

{
                "message" => "{\"action\":\"block\",\"client\":\"666\",\"request\":{\"ip\":\"90.0.0.1\",\"fqdn\":\"google.com\"},\"reason\":{\"fqdn\":\"google.com\"},\"logged\":\"2016-05-29T21:48:40-0700\",\"virus_total_request\":{\"status\":\"waiting\"},\"matched_iocs\":[{\"unique_ref\":\"f89d42211d4dd60e0266b5076148607c\",\"feed\":{\"name\":\"google-safebrowsing-api\"},\"classification\":{\"type\":\"malware\"},\"source\":{\"id\":{\"value\":\"google.com\",\"type\":\"fqdn\"},\"fqdn\":\"google.com\"},\"time\":{\"source\":\"2016-05-23T21:00:48-0700\",\"observation\":\"2016-05-23T21:00:48-0700\",\"received_by_core\":\"2016-05-23T21:00:48-0700\"},\"seen\":{\"first\":\"2016-05-23T21:00:48-0700\"}}]}",
               "@version" => "1",
             "@timestamp" => "2016-05-30T04:48:40.335Z",
                   "host" => "127.0.0.1",
                "headers" => {
              "request_method" => "POST",
                "request_path" => "/logs-2016-05-29/match/",
                 "request_uri" => "/logs-2016-05-29/match/",
                "http_version" => "HTTP/1.1",
                 "http_accept" => "text/plain",
        "http_accept_encoding" => "gzip, deflate",
                "content_type" => "application/x-www-form-urlencoded",
              "content_length" => "585",
                   "http_host" => "localhost:9090",
             "http_connection" => "Keep-Alive"
    },
                 "action" => "block",
                 "client" => "666",
                "request" => {
          "ip" => "90.0.0.1",
        "fqdn" => "google.com"
    },
                 "reason" => {
        "fqdn" => "google.com"
    },
                 "logged" => "2016-05-29T21:48:40-0700",
    "virus_total_request" => {
        "status" => "waiting"
    },
           "matched_iocs" => [
        [0] {
                "unique_ref" => "f89d42211d4dd60e0266b5076148607c",
                      "feed" => {
                "name" => "google-safebrowsing-api"
            },
            "classification" => {
                "type" => "malware"
            },
                    "source" => {
                  "id" => {
                    "value" => "google.com",
                     "type" => "fqdn"
                },
                "fqdn" => "google.com"
            },
                      "time" => {
                          "source" => "2016-05-23T21:00:48-0700",
                     "observation" => "2016-05-23T21:00:48-0700",
                "received_by_core" => "2016-05-23T21:00:48-0700"
            },
                      "seen" => {
                "first" => "2016-05-23T21:00:48-0700"
            }
        }
    ]
}