diff --git a/ansible/roles/common/templates/conf/format/apache_access.conf.j2 b/ansible/roles/common/templates/conf/format/apache_access.conf.j2
index c320132e33..c693a37358 100644
--- a/ansible/roles/common/templates/conf/format/apache_access.conf.j2
+++ b/ansible/roles/common/templates/conf/format/apache_access.conf.j2
@@ -2,7 +2,7 @@
   @type parser
   reserve_data true
   format grok
-  key_name message
+  key_name Payload
   grok_pattern \[%{HTTPDATE:Timestamp}\] "(?:%{WORD:http_method} %{NOTSPACE:http_url}(?: HTTP/%{NUMBER:http_version})?|%{DATA:rawrequest})" %{NUMBER:http_status} (?:\d+|-)
   time_key Timestamp
   time_format %d/%b/%Y:%H:%M:%S %z
diff --git a/ansible/roles/common/templates/conf/format/wsgi_access.conf.j2 b/ansible/roles/common/templates/conf/format/wsgi_access.conf.j2
index 52367b24ce..036d788c83 100644
--- a/ansible/roles/common/templates/conf/format/wsgi_access.conf.j2
+++ b/ansible/roles/common/templates/conf/format/wsgi_access.conf.j2
@@ -2,7 +2,7 @@
   @type parser
   reserve_data true
   format grok
-  key_name message
+  key_name Payload
   grok_pattern %{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:Timestamp}\] "(?:%{WORD:http_method} %{NOTSPACE:http_url}(?: HTTP/%{NUMBER:http_version})?|%{DATA:rawrequest})" %{NUMBER:http_status} (?:%{NUMBER:http_bytes}|-) (?:%{NUMBER:http_response_time_us}|-) %{QS:referrer} %{QS:agent}
   time_key Timestamp
   time_format %d/%b/%Y:%H:%M:%S %z
diff --git a/ansible/roles/common/templates/conf/format/wsgi_python.conf.j2 b/ansible/roles/common/templates/conf/format/wsgi_python.conf.j2
index d266f64cea..b929023575 100644
--- a/ansible/roles/common/templates/conf/format/wsgi_python.conf.j2
+++ b/ansible/roles/common/templates/conf/format/wsgi_python.conf.j2
@@ -2,7 +2,7 @@
   @type parser
   reserve_data true
   format grok
-  key_name message
+  key_name Payload
   grok_pattern %{TIMESTAMP_ISO8601:Timestamp} %{NUMBER:Pid} %{LOGLEVEL:log_level} %{NOTSPACE:python_module} \[(?:req-(?:%{NOTSPACE:request_id}) (?:%{NOTSPACE:user_id}) (?:%{NOTSPACE:tenant_id}) (?:%{NOTSPACE:domain_id}) (?:%{NOTSPACE:user_domain}) (?:%{NOTSPACE:project_domain})|-)\] %{GREEDYDATA:Payload}
   time_format "%Y-%m-%d %H:%M:%S.%L"
   time_key Timestamp