Use empty string for no structured data

Signed-off-by: Tero Saarni <[email protected]>

docs/index.asciidoc

@@ -239,7 +239,7 @@ use priority field if set to false
 ===== `structured_data`
 
   * Value type is <<string,string>>
-  * Default value is `nil`
+  * There is no default value for this setting.
 
 RFC5424 structured data is a string of one or more structured data elements, including brackets.
 The elements need to be formatted according to link:https://datatracker.ietf.org/doc/html/rfc5424#section-6.3[RFC5424 section 6.3], for example:

lib/logstash/outputs/syslog.rb

@@ -126,7 +126,7 @@ class LogStash::Outputs::Syslog < LogStash::Outputs::Base
   config :rfc, :validate => ["rfc3164", "rfc5424"], :default => "rfc3164"
 
   # RFC5424 structured data.
-  config :structured_data, :validate => :string, :default => nil
+  config :structured_data, :validate => :string, :default => ""
 
   def register
     @client_socket = nil
@@ -145,7 +145,7 @@ def register
     # use instance variable to avoid string comparison for each event
     @is_rfc3164 = (@rfc == "rfc3164")
 
-    if @is_rfc3164 && !@structured_data.nil?
+    if @is_rfc3164 && !@structured_data.empty?
       raise LogStash::ConfigurationError, "Structured data is not supported for RFC3164"
     end
 
@@ -177,7 +177,7 @@ def publish(event, payload)
       syslog_msg = "<#{priority.to_s}>#{timestamp} #{sourcehost} #{appname}[#{procid}]: #{message}"
     else
       msgid = event.sprintf(@msgid)
-      sd = @structured_data.nil? ? "-" : event.sprintf(@structured_data)
+      sd = @structured_data.empty? ? "-" : event.sprintf(@structured_data)
       timestamp = event.sprintf("%{+YYYY-MM-dd'T'HH:mm:ss.SSSZZ}")
       syslog_msg = "<#{priority.to_s}>1 #{timestamp} #{sourcehost} #{appname} #{procid} #{msgid} #{sd} #{message}"
     end