sc4s app_parsers don't seem to work

[davidoff96]

Hello,

We're currently having an issue of SC4S tagging Cisco firepower data as nix:syslog, but I was having this issue even when I was doing some testing on a dev instance. Example log (only the starting section)

(null) %NGIPS-7-430003: EventPriority: Low, DeviceUUID:....

And I basically want to match only on that starting "(null) %NGIPS-"

My conf file (app_parsers/app-syslog-cisco_firepowernull.conf):

block parser app-syslog-firepowernull() {
    channel {
        rewrite {
            r_set_splunk_dest_default(
                index("main")
                sourcetype('cisco:firepower:syslog')
                vendor("cisco")
                product("firepower")
            );
        };
    };
};
application app-syslog-firepowernull[sc4s-syslog] {
    filter {
        message("*(null) %NGIPS*" type(glob));
    };
    parser { app-syslog-firepowernull(); };
};

 
I made no other changes. I am aware I can also change this with the compliance csv, but I'd rather do it this way, especially if we will have new log sources in the future.

After making these changes and reloading (and I know that syslog-ng can see it, because I had a typo originally and it crashed lol), the logs are still tagged with vendor as "nix" and product as "syslog". The sourcetype is also still nix:syslog. Am I missing something? I found the documentation confusing when regarding this. 

Also, what does the [] mean in the application name? I have tried several different values, and it seemed to make no difference.