Hi all,
the CEE spec from early this year says that a syslog message with @cee MUST contain JSON content only, and not a message. Take for example this syslog payload:
@cee:{"f":"1"} some text
As of the spec, this is not CEE-enhanced syslog and as such NO JSON object is to be generated. Instead, this would need to be encoded as
@cee:{"f:":"1", "msg":"some text"}
To create a proper CEE-enhanced message.
I wonder what our position in lumberjack is in regard to this. My impression is that the "invalid" format (the first sample) will be seen in practice.
Comments?
Rainer