The top level User Journal Fields are missing in the label map because they do not have the preceding _.

This means you miss labels like syslog_identifier among others

This is the regex:

    rule {
      action = "labelmap"
      regex = "__journal__?(.+)"
    }