Another alternative to regular expression based message parsing that has native support within syslog-ng: patterndb (http://www.balabit.com/network-security/syslog-ng/opensource...)

Very fast and a bit complex to setup, but well documented and well tooled. Mature. It could do with some more community love, tbh.