Problem with syslog formating

Hi, I’m currently running Graylog 6.0 and receiving logs from Cisco switches, through a syslog UDP input. The logs follow this format:

<189>124087: Jul 8 2024 10:58:43.417 EDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/2, changed state to up

It mostly manages to extract the fields correctly, however it sets the source as the milliseconds of the timestamp (417 in the above example).

The only pipeline I have running is one to get the string representation of the severity. I’m really struggling to find a way to make it work, so I would greatly appreciate any pointers. Thanks!