Probably yes, but it would be awesome to have the http://logback.qos.ch/manual/appenders.html documentation page improved stating that you can pass the syslog tag as the first word in the suffixPattern (basically a string that matches the /[^ ]*/ pattern)