fix logstash syslog grok filter

RSYSLOG_ForwardFormat uses ISO8601 timestamps rather than traditional
syslog timestamps.