chore: restructuring grammar for Cisco IOS case

Signed-off-by: Leonardo Di Donato <[email protected]>

Author: leodido

rfc3164/machine.go.rl

@@ -177,11 +177,12 @@ sequence = (sequenceval ':' sp*) when { m.sequence };
 ciscoHostname = (hostname ':' sp*)? when { m.ciscoHostname };
 # and then they prepend a '*' to the timestamp if there is no NTP sync
 ciscostar = ('*'?) when { m.msgcount || m.sequence || m.ciscoHostname };
-ciscoextras = msgcount? <: sequence? <: ciscoHostname? ciscostar;
 # and they append a colon after the timestamp:
 # ...19:46:03.295: ...
 ciscocolon = (':'?) when { m.msgcount || m.sequence || m.ciscoHostname };
 
+ciscoextras = msgcount? <: sequence? <: ciscoHostname?;
+
 # Section 4.1.3
 # note > alnum{1,32} is too restrictive (eg., no dashes)
 # note > see https://tools.ietf.org/html/rfc2234#section-2.1 for an interpretation of "ABNF alphanumeric" as stated by RFC 3164 regarding the tag
@@ -204,7 +205,7 @@ fail := (any - [\n\r])* @err{ fgoto main; };
 
 # note > some BSD syslog implementations insert extra spaces between "PRI", "Timestamp", and "Hostname": although these strictly violate RFC3164, it is useful to be able to parse them
 # note > OpenBSD like many other hardware sends syslog messages without hostname
-main := pri sp* ciscoextras (timestamp | (rfc3339 when { m.rfc3339 })) ciscocolon sp+ (hostname sp+)? msg '\n'?;
+main := pri sp* ciscoextras ciscostar (timestamp | (rfc3339 when { m.rfc3339 })) ciscocolon sp+ (hostname sp+)? msg '\n'?;
 
 }%%