syslog input not following RFC3164

[jordansissel]

(This issue was originally filed by @fajabird at elastic/logstash#2812)

---

RFC3164 states the following:

1. "The HEADER part contains a timestamp and an indication of the
   hostname or IP address of the device"
2. "The MSG part has two fields known as the TAG field and the CONTENT
   field."
3. "Any non-alphanumeric character will terminate the TAG field and will be
   assumed to be the starting character of the CONTENT field."

But logstash's syslog-input expects the TAG-Field to be terminated by a ":" which will not match some syslog-conform messages.

I manually modified the file "logstash/patterns/linux-syslog" to become the TAG optional:

OLD:
SYSLOGBASE2 (?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:

NEW:
SYSLOGBASE2 (?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource}( %{SYSLOGPROG}:)?

Could this become available in the upstream?