more accurate fd.is_syslog filter field