[syslog-ng]group () doesn't work