This forum thread has some good info on getting regex's working in rsyslog:
http://kb.monitorware.com/regular-expressions-with-rsyslogd-t10055.htmlAlso, I found this tool:
http://www.rsyslog.com/user-regex.phpScreenshot attached of my test. I had to remove the ? from the pattern I provided to get it working.