The article on structured logging (https://nxlog.co/why-use-structured-logging) shows how you should use structured logging so that changes in log format is minimized. The example of the sysmon event, process creates, shows what I think is a bug in NXLog.
The ProcessID in the "Message" is the ProcessID (25848) of the new process that sysmon sees created. However, in the structured NXLog key/values, the ProcessID is that of sysmon itself (1680)
The only way to get the ProcessID of the process sysmon observed created, is to use regular expressions. Can you verify that this is a bug in NXLog?