logstash/logstash — pull request #586 by bfritz (2013-08-22 15:33:30+00:00)
Title: nil instead of "-" for missing structured data with grok pattern for rfc 5424 syslog

When RFC 5424 syslog lines have "-" in place of structured data, the SD should be nil.

Third commit is optional. Backreferences are not needed, but I did not test to see if disabling them improves performance...and it does make the pattern more verbose.