I just added the capability to have an "official" filler field type. Details here: http://blog.gerhards.net/2011/11/filler-fields-in-log-normalization.html rainer