Here's a working regex.
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ liblogging-stdlog: \[origin
software="rsyslogd" swVersion="[0-9.]+" x-pid="[[:digit:]]+"
x-info="http:\/\/www\.rsyslog\.com"\] rsyslogd was HUPed$I made a couple of minor changes but changing rsyslogd to liblogging-stdlog should do it.
