Tersified from rsyslog.com properties, See it for the real deal.
 
msg                 
rawmsg              for debugging and forwarding unaltered. 

                    EscapecontrolCharactersOnReceive is enabled by default, so it may be different from what was received 
rawmsg-after-pri     the same as rawmsg, syslog PRI is removed. (avoid)

hostname, source

fromhost
fromhost-ip         system the message was received from (consider a relay)

syslogtag        TAG from the message
programname      "static" part of the tag, For example, when TAG is "named[12345]", programname is "named".


pri              
pri-text         with the numerical PRI appended in brackes (e.g. “local0.err<133>”)
syslogfacility          numerical 
syslogfacility-text
syslogseverity,          numerical 
syslogpriority
syslogseverity-text,
syslogpriority-text

timereported,        from the message
timestamp           Apr 17 21:10:31  Mon dd hh:mm:ss
timegenerated       message was RECEIVED. Always in high resolution (beware of timezone and sync timme variations)

iut              monitorware InfoUnitType 

    fields from IETF draft 
protocol-version    PROTCOL-VERSION 
structured-data     STRUCTURED-DATA
app-name            APP-NAME
procid              PROCID
msgid               MSGID 

inputname           input module that generated the message (e.g. “imuxsock”, “imudp”). 
jsonmesg            as JSON representation. 

$bom            UTF-8 encoded Unicode byte-order mask (BOM). 
$myhostname    name of the current host 
$now        not from the message. 
$now-utc

Due to the complex handling of messages - including entry into a database - there are several subtly different timestamps available.
Within a single template, only the localtime or UTC variant should be used. 

$now     YYYY-MM-DD   ¿
$year   yyyy
$month    mm
$day      dd
$hour     hh
$hhour current half hour 0 - 1
$qhour current quarter hour 0 - 3 
$minute   MM

See property replacer to "pick apart various properties.