It looks like you tried to compile multiple policies into one.
Each original had a statement with its array of statements and you nested them.
This (untested) should work with each statement block within the array of Statement of the policy:
How do I send a structured message?
If you want structured messages check out some of the recommended third party logging options. Some of these options have built-in support for Elasticsearch logging. For instance, Serilog provides a "sink" for putting logs directly into Elasticsearch.
How do I configure it in code?
These options all tie into the ...