updates to correlation for new JSON from upgrading Syslog-NG 3.5