in path location /usr/share/filebeat/module/system/syslog/ingest/pipeline.json following pattern code grok pattern is confusing. why the double slash \\ comes for [%{POSINT:system.syslog.pid}\]
"grok": {
"field": "message",
"patterns": [
"%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{SYSLOGHOST:system.syslog.hostname} %{DATA:system.syslog.program}(?:\\[%{POSINT:system.syslog.pid}\\])?: %{GREEDYMULTILINE:system.syslog.message}",