fd.is_syslog filter field