no matter what you set the max message size to, if you allow user created fields
there is going to be some time when the log messages get too large to process.
The traditional syslog method is to truncate the message when you hit the limit
(originally 1k, but with modern syslogs, configurable by the admin)
However, when the message is a JSON structured log, what is the proper way to
deal with this problem, and how do the various syslog daemons handle this case?
I recently threw together a quick program to scrape java errors and send them to
syslog, I made it split the messages into 4k chunks (with message 2/4 type
tags), but I didn't test the case where a message didn't have a single space or
tab character in a 4k chunk and had the program go into a spin while trying to
send a production message that was like that.
David Lang