correlation change to pop syslog data before persisting message