[syslog-ng] pattern matching against raw input?