The connector is going to be expecting a specific format, likely the original format of the firewall. If rsyslog manipulates/changes the log lines, the connector isn't going to know what to do with that data any more.
We have some intelligence for syslog servers modifying data built around Kiwi Syslog, so this may be something that could be sent up as a feature request.