rfc5424-logging-handler
rfc5424-logging-handler copied to clipboard
Allow option to override structured data id length limit
RFC5424 limits the structured data id(sd-id) to be max of 32 characters in length
...
STRUCTURED-DATA = NILVALUE / 1*SD-ELEMENT
SD-ELEMENT = "[" SD-ID *(SP SD-PARAM) "]"
SD-PARAM = PARAM-NAME "=" %d34 PARAM-VALUE %d34
SD-ID = SD-NAME
PARAM-NAME = SD-NAME
PARAM-VALUE = UTF-8-STRING ; characters '"', '\' and
; ']' MUST be escaped.
SD-NAME = 1*32PRINTUSASCII
; except '=', SP, ']', %d34 (")
...
But in real world there are many applications that doesn't honour this limit. Many syslog aggregators use structured data to pass the ingest/auth token. The ingest/auth tokens are generally more than 32 characters. For example, Loggly uses uuid as token which more than 32 characters. Sumo Logic uses random string which is also more than 32 characters.
Considering the real world usages of structured data, it would be useful if there is a way to override structured data id length.