Do you have any config for syslog-ng for extracting this?