We rely on the syslog facility to write the logs so the message are consistent to syslog.

The format is as follows.

Date Time hostname source(sts_component_name)[PID]:[severity level keyword] {component instance #} {component instance #-dup} message 
IE: Nov 1 01:01:15 silvertswddprc mitigator[8540]:[crit] 0 0 message

The numbers between severity level keyword and message represent the instanceID of the component.

Some components can have multiple instances running on the same server.

In such cases, the instanceID would tell the difference.

The PID would be different as well but the Instance would tie it back to the service name which also ends with the instanceID