[syslog-ng] substr function issues