datetime.rs support syslog formats

Be more specific about matching syslog formats earlier in
the matching process.

Also, be more sure about what comes after the last match in all
patterns.