updates to correlation for syslog-ng parser