The grok rule above is missing an optional '(?:%{NONNEGINT:syslog5424_ver} )?' right after %{SYSLOG5424PRI}, in order to catch the syslog version '1' output on loggregator messages.