diff --git a/src/analysisd/cleanevent.c b/src/analysisd/cleanevent.c
index 7df8685ea..cb99892b8 100644
--- a/src/analysisd/cleanevent.c
+++ b/src/analysisd/cleanevent.c
@@ -104,12 +104,10 @@ int OS_CleanMSG(char *msg, Eventinfo *lf)
     if (pieces[0] == '<') {
         /* Increment past the < */
         pieces++;
-        lf->log++;
         /*move past the 1-3 digits
         Increment lf->log along the way */
         while (isdigit((int)*pieces)) {
             pieces++;
-            lf->log++;
         }
         if (
             (pieces[0] == '>') && 
@@ -120,13 +118,12 @@ int OS_CleanMSG(char *msg, Eventinfo *lf)
             pieces += 2;
             pieces[0] = '\0';
             pieces++;
-            lf->log += 3;
+            lf->log = pieces;
         } else {
             /* Walk back to the beginning as not Syslog protocol 23 */
             pieces--;
             while (isdigit((int)*pieces)) {
                 pieces--;
-                lf->log--;
             }
 
         }