IETF syslog grok fixes :-(

Meh. Should not work at this time of the day...