----- Original Message -----
Hi all,
the CEE spec from early this year says that a syslog message with
@cee MUST contain JSON content only, and not a message. Take for
example this syslog payload:
@cee:{"f":"1"} some text
As of the spec, this is not CEE-enhanced syslog and as such NO JSON
object is to be generated. Instead, this would need to be encoded as
@cee:{"f:":"1", "msg":"some text"}
To create a proper CEE-enhanced message.
I wonder what our position in lumberjack is in regard to this. My
impression is that the "invalid" format (the first sample) will be
seen in practice.
The second one seems much preferable to me; if the first one were officially allowed,
someone would next stick the @cee:{} part at the end or in the middle of the record.
libumberlog already forces you to provide a "msg" text and encodes it within the
@cee payload, so there is some chance that most programs will follow that model.
Also, for Fedora we are planning a configuration that would nicely support the
"msg" field but not adding arbitrary text at the end.
Mirek