The golden nugget of information here is:
Logstash will send the content of the event as
event
attribute inside theparams
.
I spent quite some time trying to find this in the documentation, and if it is in there, I couldn't find it.
Thanks for your help.