I'm using syslog-ng 3.0.3 to collect and forward some messages to another syslog-ng 3.0.3 server. The messages are in the following format and are received via UDP:

Jul 7 11:26:53 SERVERNAME [aaa][info] xmlfirewall(Testservices): trans(534491553)[request]: Policy(Testpolicy): Message allowed

I use the following destination configuration:
destination testserver { udp("testserver" port(514)); };

The messages arrive in this format:
Jul 7 11:26:53 SERVERNAME [info] xmlfirewall(Testservices): trans(534491553)[request]: Policy(Testpolicy): Message allowed

It removed the [aaa] from the original message. I tried adding a template to the destination that used $MSG, but it didn't change the output. Is there a way to tell syslog-ng to not modify the original message? I don't recall having this issue with version 2.0.x.

Thanks,

Steve