Nice, thats a good idea. I am using a ruby filter to create a new field named "combined_data" using code => ' event.set( "combined_data", event.to_json ) '
However, my syslog output still only transmits the content of the message field. My configuration looks like this:
output {
syslog {
host => ...
port => ...
message => "%{combined_data}"
}