I'm not sure I'm phrasing my question correctly, but the idea of what I'm trying to achieve is this:
<filter systemd.**>
@type record_modifier
<record>
service $NameOfASystemdServiceFromTheEntry
</record>
</filter>
so service key would docker.service or ntp.service or whatever service actually produced the log entry. Is this possible?