rewritten plugin - there's now a Syslog (Raw Join) and a Syslog (Raw Split), that deal with both popular specifications and allow extension via structured data in the message part.