I would like to convert an event similar to the one below to be a single event when sending it out to an external Syslog server
time: 20180717112345
dn: uid=123,ou=employees,ou=ddd,ou=ddd,o=ddd,dc=ddd,dc=ddd
changetype: modify
replace: userPassword
replace: modifiersName
modifiersName: uid=ddd,ou=ddd,ou=ddd,ou=ddd,o=ddd,dc=ddd,
replace: modifyTimestamp
replace: passwordRetryCount
a uf will ignore props and transforms, you will need a heavy forwarder on your syslog server.
I have a heavy forwarder on the rsyslog server but the rsyslog is taking each line as a separate event