[syslog-ng]regex question