Precision: I'm using "classic" rsyslog to forward syslogs to logstash server on port 5514
I hope this is what you want, I got it from stdout ouput:
{
"@version" => "1",
"message" => "<11>Jan 29 16:17:56 my-server setroubleshoot: SELinux is preventing ... etc.",
"host" => "my-server.example.com",
"@timestamp" => 2021-01-29T15:17:56.229Z,
"port" => 53280
}