On Mon, Apr 2, 2012 at 4:17 PM, William Heinbockel <wheinbockel(a)gmail.com>wrote:
What are people's opinions on the Syslog priority and facility
being
supported in the field list?
..
After all, when you encode the event data into structured text, the
priority/facility are still present in the Syslog header. Carrying
them over into the event data as is makes little sense being that they
are specific to the Syslog protocol.
There's 2 questions here: how useful are they, and should they be
supported. Facility is a notch above useless, and a lot - I'd say most - of
the use today is as a simple way to represent something else. Usually
that's because a specific daemon logs using a specific facility, or they've
configured sources to use localN.
Severity has the problems that come with any one-size-fits-all assessment
of severity, and then every daemon author has their own view of what's
severe. It's widely used by authors, though, and it's the best info
available.
I'd argue that they aren't very useful, but I agree with David and Balasz
that the values (or at least the priority integer) need to be retained.
Troy