Is that we pull the value from a different flag for syslog events. Otherwise it uses the standard osquery events system.