improved parsing of syslog additional fields