[syslog-ng] Question on message parsing amd formats