Hi Evan,
Currently we are achieving this using rfc5424 by prepending all fields with `.SDATA.` on the sender and stripping it off on the receiver.
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq