I had the same issue with the syslog output plugin, I'm pretty sure that the variable message of the pipeline leaks into the plugins message variable, so you get a literal %{message}. So I changed the plugins variable to raw_message and my problem was solved. I also had issues with the TLS retry handling so I forked the repo and now pushed my changes. I haven't contacted the logstash-plugin maintainers or created a pull request, but I don't see much action in their repo on other pull requests.