> As an alternative solution, we could do the same as what the syslog input does, at the logstash-filters-common level.

That is a better idea.  PR? :)