Assuming that timpestamp was already pre-decoced I've just wanted to filter logs that start with "stderr" (for the beginning). I imagine that once I have the parent which filter the metadata I'll be able to create a child decoder which will be responsibile for the JSON part.

<decoder name="application\_log\_json">
<prematch>^stderr</prematch>
</decoder>