Fix the timestamp regex to handle multiple spaces.

The current regex does not parse timestamps with multiple
spaces (like "Dec  1 00:00:00") properly, now we handle that.

We're not using 'format syslog' since we only want the timestamp.
I copied the old regex from the fluentd in_tail documentation,
however, this was incorrect and does not match the actual regex
used in 'parser.rb' (which is what I'm using now).