Event Transform to fill eventkey

Hi,

I have a load balancer that sends syslog messages to zenoss.
What i'm trying to achieve is that the messages get handled correctly with a transform.
Below two messages it spits out when i enable and disable a real server.
What i want is that the eventkey gets set to the realserver and virtualserver ip like : 192168132880VS19216813113443

RS 192.168.13.28:80 disabled on VS 192.168.13.113:443(Farm_C_SSL)
Adding RS 192.168.13.28:80 to VS 192.168.13.113:443(Farm_C_SSL)

Is there anyone who can explain me how to do this

Thanks

Kind regards,
Harm Jan