title: automatically map fields in syslog "message" section
body: <p>Is it possible to automatically map fields for events I would receive by syslog, if they follow a format <code>field1=value1 field2=value2 ...</code> ? An example would be</p>
  
  <pre><code>name=john age=15
  age=29 name=jane
  name=mark car=porshe
  </code></pre>
  
  <p>(note that the fields are different and not always there)</p>
  
  <p>One of the solutions I am considering is to send the syslog "message" part as JSON but I am not sure if it possible to automatically parse it (when the rest of the log is in syslog format). My current approach fails with <code>_jsonparsefailure</code> but I will keep trying</p>
  
  <pre><code>input {
    tcp
      {
        port =&gt; 5514
        type =&gt; "syslogandjson"
        codec =&gt; json
      }
  
  }
  
  filter{
      json{
        source =&gt; "message"
      }
  }
  
  output ...
  </code></pre>