^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ rsyslogd:[[:space:]]+imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' \(fd 3\) from systemd\.  \[v[[:digit:].]+\]$
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ rsyslogd:[[:space:]]+\[origin software="rsyslogd" swVersion="[[:digit:].]+" x-pid="[[:digit:]]+" x-info="https://www.rsyslog.com"\] rsyslogd was HUPed$
^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ rsyslogd:[[:space:]]+\[origin software="rsyslogd" swVersion="[[:digit:].]+" x-pid="[[:digit:]]+" x-info="https://www.rsyslog.com"\] start$