Closed psychickita closed 7 years ago
@psychickita First don't send a PR without explaining it. Sorry but firehose-to-syslog is not SPLUNK related or not ... If you are going to add splunk related things this, should be done in the splunk nozzle not in the firehose-to-syslog one.
Apologies for not explaining better: our nozzle relies on syslog code and I did not want to duplicate code or effort. It seems reasonable that metadata fields may into a dedicated section of a payload, rather than just into the raw event itself. If that does not make sense, any thoughts on having a library for different nozzles to use, so that similar code is not floating around in multiple variations?
…ds" metadata