Okay, the issue seems to be with setting the “facility” value. If I change it to something like “facility_string” the set_field command works. It just doesn’t let me set the “facility” value as a string, but I can set it as an integer. What I want the facility field to be though is the named value like local7, etc. just like the Syslog UDP input does. It looks like someone else may have come across this same issue, but it doesn’t appear to have been resolved.