at the moment the syslog input is only rfc3164 compatible.
http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.1-guide-admin-en.html/concepts_message_ietfsyslog.html
thought i would also provide a patch, i guess we can easily add the optional syslog_version field, but that's not enough.
severity and facility look like there are the same but SYSLOGLINE is not rfc5424 ready.
We are dropping 'plugin'-based syslog parsing support, so adding RFC5424 support probably belongs in the cookbook (cookbook.logstash.net)
Happy to discuss further
I will be very pleased to see an example for the structured data field parsing (http://tools.ietf.org/html/rfc5424#section-6.3) in a cookbook.