parser.rb: Make ':' optional after pid

In some cases, there is no ':' after the pid, the following log would fail to parse

```
<77>Jul 11 15:14:01 my.example.com run-parts(/etc/cron.daily)[8231] finished logrotate
```

resulting in

```
"_source": {
    "data": "<77>Jul 11 15:14:01 my.example.com run-parts(/etc/cron.daily)[8231] finished logrotate",
    "message": "invalid syslog message data=\"<77>Jul 11 15:14:01 my.example.com run-parts(/etc/cron.daily)[8231] finished logrotate\"",
    "@timestamp": "2014-07-11T19:14:01+00:00"
  },
```

This PR aims to make those ':' after the pid optional