[syslog-ng] Question on parsing