- /^(.+>)$/ can fix logs that have a space after the pri. Eg "<123> Jan 1 ..." ----> "<123>Jan 1 ..." - /^(<\d+>\d\d\d\d)$/ can fix logs that have a year as start of date. Eg "<123>2001 Jan 1..." ----> <123>2001 Jan 1..." And add something like /^\S+\[\S+]:.*$/ to passing the syslog appName, pid and message