nil instead of "-" for missing structured data with grok pattern for rfc 5424 syslog

When RFC 5424 syslog lines have "-" in place of structured data, the SD should be nil.

Third commit is optional.  Backreferences are not needed, but I did not test to see if disabling them improves performance...and it does make the pattern more verbose.