Hello,

It's possible but you will need to write this table in your config.
We have im_msvistalog input module, it parses incoming messages and adding additional fields like $LogonType.
With it you could use simple if-else statement to check, what is this type, and add a new field or change already existing, depends on your needs. Something like this:

<Exec>
    if $LogonType == 2 $NewMessage = "Interactive";
    else if $LogonType == 3 $NewMessage = "Network";
    else if $LogonType == 4 $NewMessage = "Batch";
    else if $LogonType == 5 $NewMessage = "Service";
</Exec>    

Also you can parse the entire $raw_message using regex but it will take much more resources and I'm not is this makes any sense.
Let us know if this was useful you.

Best regards, Arch