Hi Asif!
I think the problem with the first message comes from the message structure and the filter statement.
Its structure does not conform to either syslog RFC standards (RFC3164 or RFC5424).
Syslog-ng still tries to parse the log message by its internal heuristics and the "alarmLog" text is parsed as the 'program' field.
You can debug syslog-ng parsing with the format-json template in the destination:
`template("$(format-json -s syslog-proto)\n")`
The output for this was:
{"PROGRAM":"alarmLog,","PRIORITY":"notice","MESSAGE":"applianceName=Branch-UC1, tenantName=DEMO-CORP, alarmType=sla-not-met, alarmKey=INTERNET, generateTime=1521503387, applianceId=1, vsnId=0, tenantId=2, alarmCause=datapathState, alarmClearable=yes, alarmClass=cleared, alarmKind=symptom, alarmEventType=equipmentAlarm, alarmSeverity=cleared, alarmOwner=tenant, alarmSeqNo=1568, alarmText=delay:9 msec, siteName=Branch-UC1","HOST":"+0000","FACILITY":"user","DATE":"Mar 13 23:49:48"}
The filter statement uses the `match()` filter which works on both the header and message part of the log message and thus would match for the first log message if the `value("MESSAGE")` part would not be there.
With that you restricted the filter to match only on the message part.
If you remove the value("MESSAGE") from the filter statement it will work.
Regards,
Gabor