no matter what you set the max message size to, if you allow user created fields there is going to be some time when the log messages get too large to process. The traditional syslog method is to truncate the message when you hit the limit (originally 1k, but with modern syslogs, configurable by the admin)
However, when the message is a JSON structured log, what is the proper way to deal with this problem, and how do the various syslog daemons handle this case?
I recently threw together a quick program to scrape java errors and send them to syslog, I made it split the messages into 4k chunks (with message 2/4 type tags), but I didn't test the case where a message didn't have a single space or tab character in a 4k chunk and had the program go into a spin while trying to send a production message that was like that.
David Lang