syslog_pri {} has to be after the grok