The issue is if we don't escape or replace at LF then the rsyslog treats it as a separate message, but doesn't include the same header information.