Update 10-pf.conf

conf.d/10-pf.conf

@@ -11,10 +11,8 @@ filter {
       locale => "en"
     }
     mutate {
-      replace => [ "message", "%{msg}" ]
-    }
-    mutate {
-      remove_field => [ "msg" ]
+      copy => { "[message]" => "[event][original]"}
+      replace => [ "syslog_message", "%{message}" ]
     }
   }
 }