You really want a command executed or just want to echo the value of the fields extracted into a file?
I really wouldn't recomment trying to run a command that can be triggered for every incoming message, it can easily lead to a DoS, simply by flooding the syslog server with a lot of logs.
Hmm... db-parser() is able to rate-limit actions though, the only needed thing is a command execution. Too bad it's too easy to inject badly formatted values into the command line, which is a security issue.
In your example: cat $user, what if $user contains the the string "'; rm -rf /"? it would get executed in an innocent looking configuration.