diff --git a/.chloggen/drosiek-syslog-receiver-attributes.yaml b/.chloggen/drosiek-syslog-receiver-attributes.yaml
new file mode 100755
index 0000000000000..8db816cb60b37
--- /dev/null
+++ b/.chloggen/drosiek-syslog-receiver-attributes.yaml
@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: syslogparser
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: return correct structure from syslog parser
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [27414]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user]
diff --git a/pkg/stanza/operator/input/syslog/syslog_test.go b/pkg/stanza/operator/input/syslog/syslog_test.go
index d1fc08fddac1c..b2f604a8b0df4 100644
--- a/pkg/stanza/operator/input/syslog/syslog_test.go
+++ b/pkg/stanza/operator/input/syslog/syslog_test.go
@@ -49,8 +49,8 @@ var (
 				"msg_id":   "ID52020",
 				"priority": 86,
 				"proc_id":  "23108",
-				"structured_data": map[string]map[string]string{
-					"SecureAuth@27389": {
+				"structured_data": map[string]interface{}{
+					"SecureAuth@27389": map[string]interface{}{
 						"PEN":             "27389",
 						"Realm":           "SecureAuth0",
 						"UserHostAddress": "192.168.2.132",
diff --git a/pkg/stanza/operator/parser/syslog/data.go b/pkg/stanza/operator/parser/syslog/data.go
index 4cac059a074ec..378aa69d0b42e 100644
--- a/pkg/stanza/operator/parser/syslog/data.go
+++ b/pkg/stanza/operator/parser/syslog/data.go
@@ -159,8 +159,8 @@ func CreateCases(basicConfig func() *Config) ([]Case, error) {
 					"msg_id":   "ID52020",
 					"priority": 86,
 					"proc_id":  "23108",
-					"structured_data": map[string]map[string]string{
-						"SecureAuth@27389": {
+					"structured_data": map[string]interface{}{
+						"SecureAuth@27389": map[string]interface{}{
 							"PEN":             "27389",
 							"Realm":           "SecureAuth0",
 							"UserHostAddress": "192.168.2.132",
@@ -197,8 +197,8 @@ func CreateCases(basicConfig func() *Config) ([]Case, error) {
 					"msg_id":   "ID52020",
 					"priority": 86,
 					"proc_id":  "23108",
-					"structured_data": map[string]map[string]string{
-						"SecureAuth@27389": {
+					"structured_data": map[string]interface{}{
+						"SecureAuth@27389": map[string]interface{}{
 							"PEN":             "27389",
 							"Realm":           "SecureAuth0",
 							"UserHostAddress": "192.168.2.132",
@@ -235,8 +235,8 @@ func CreateCases(basicConfig func() *Config) ([]Case, error) {
 					"msg_id":   "ID52020",
 					"priority": 86,
 					"proc_id":  "23108",
-					"structured_data": map[string]map[string]string{
-						"SecureAuth@27389": {
+					"structured_data": map[string]interface{}{
+						"SecureAuth@27389": map[string]interface{}{
 							"PEN":             "27389",
 							"Realm":           "SecureAuth0",
 							"UserHostAddress": "192.168.2.132",
diff --git a/pkg/stanza/operator/parser/syslog/syslog.go b/pkg/stanza/operator/parser/syslog/syslog.go
index 674e3db64c2c5..05c12addab4fe 100644
--- a/pkg/stanza/operator/parser/syslog/syslog.go
+++ b/pkg/stanza/operator/parser/syslog/syslog.go
@@ -243,7 +243,7 @@ func (s *Parser) toSafeMap(message map[string]interface{}) (map[string]interface
 				delete(message, key)
 				continue
 			}
-			message[key] = *v
+			message[key] = convertMap(*v)
 		default:
 			return nil, fmt.Errorf("key %s has unknown field of type %T", key, v)
 		}
@@ -252,6 +252,22 @@ func (s *Parser) toSafeMap(message map[string]interface{}) (map[string]interface
 	return message, nil
 }
 
+// convertMap converts map[string]map[string]string to map[string]interface{}
+// which is expected by stanza converter
+func convertMap(data map[string]map[string]string) map[string]interface{} {
+	ret := map[string]interface{}{}
+	for key, value := range data {
+		ret[key] = map[string]interface{}{}
+		r := ret[key].(map[string]interface{})
+
+		for k, v := range value {
+			r[k] = v
+		}
+	}
+
+	return ret
+}
+
 func toBytes(value interface{}) ([]byte, error) {
 	switch v := value.(type) {
 	case string: