[syslog-ng] question about message parsing behavior