You can also strip it down to just the JSON or XML message this way:
http://answers.splunk.com/answers/201739/how-to-get-a-sourcetype-of-json-mixed-with-text-th.html
If it is XML, add the following to you props.conf
SEDCMD-stripnonxml-1=s/^.*msg_body="//
SEDCMD-stripnonxml-2=s/\"$//
... View more