add 'optional' option for literals and whitespace

[davidelang]

it's unfortunately common to have logs that differ only in having whitespace or having a literal.

even rsyslog has problems with this, if you generate a traditional formatted message, the syslogtag will have a : on it if the inbound log was an old-style message, but not if the inbound log was a rfc5424 message.

I have many logs that I receive that sometimes have a space at the beginning of the message and sometimes don't

if there is a varying amount of whitespace, that is easy to deal with, but there's no option to say '0 or more whitespace characters'

I've tried doing custom types with alternates to allow ': ' or ' ' to deal with the : there or not, and it hasn't worked well