Logstash-output-syslog full json in message?

Aren't you using a syslog output to write to the SIM? (Did you mean SEIM?) What does that output look like?