Allow optional space between sysloghost and colon.

Closes elasticsearch/logstash#2101. If a Cisco ASA has a logging
device-id set, the syslog message emitted contains an additional space
after the device-id and therefore does not match the grok pattern
CISCO_TAGGED_SYSLOG. An optional space should be allowed by the pattern
between the device-id (which is captured as sysloghost) and the colon
character.