<PRI>VER TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SOURCETYPE@NM_IANA key1="val1" key2="val2" etc.]
example:
<34>1 2003-10-11T22:14:15.003Z mymachine.example.com su ID47 d25c5bf1 - BOM'su root' failed for lonvick on /dev/pts/8
<PRI>TIMESTAMP HOSTNAME APP-NAME[PROCID]: sourcetype="SOURCETYPE" key1="val1" key2="val2" etc.
example:
<34>Oct 11 22:14:15 mymachine.example.com su[ID47]: - BOM'su root' failed for lonvick on /dev/pts/8