support more syslog header fields