I do not think APPNAME belongs in the top level grok patterns, this is really  a syslog specific thing we want to fix here.