I believe you're correct, and using Logstash to rename the fields would be the workaround.
Another item to be aware of - when working with Windows Server 2003, you'll likely run into the log message parameters not being named. There's a detailed explanation from a past discussion here.