updates to correlation for new JSON form Syslog-NG 3.5