[908] Support matching even with rsyslog pre-amble