Thank you so, so much!. I am really looking forward to that change.
err, sorry to bother you, but is there a chance that the implicit processing within the syslog input would get separated in the same way? I mean - the syslog input sometimes detects and parses key=value pairs on its own, creating unwanted fields that are hard or impossible to get rid of.
I work this around by using Raw input (does not work for length-prefix framed messages), but being able to (re)move that step would allow a much more generic solution - e.g. sanitizing the input with extractors.