Sure, I'll add the syslog parsing later today. I'm assuming we'd maintain the name ingestor_syslog - otherwise it'd have to be split between ingestor_tcp/udp?