Github user ottobackwards commented on the issue:
https://github.com/apache/metron/pull/1245
Given we have the 5424 parser, and the 3164 parser in PR already, with
chaining, perhaps this parser would be cleaner and easier to configure and
understand if it was re-positioned ( wrt syslog ) as being a chained parser,
that parser the MSG portion of either upstream parser.
Then your examples could be a bit simpler.---
