It can already parse json. I guess this whole thing was partly due to inexperience from me. I only used the transform module because I thought I needed caddy to output its own program name in its log messages. But I already overcame this by using an own unix socket (e.g. /var/caddy/var/run/log) and sending all caddy logs to that.
This way, the source is tagged automatically and I can use a syslog-ng rewrite rule to set the program name in that application. Now I don’t need to modify the output of caddy at all (apart from rfc3339 for time but thats supported.)
Sometimes just writing about things or talking with somebody is already a big help. Thanks for helping me here and on github too. 