Updated field extractions to use sourcetype=syslog

Since RHEL logs puppet agent and master to /var/log/messages some fields weren't extracting, I updated props and transforms to extract fields from both sources, which seemed to work..