Added support for RFC5424 structured data

[tsaarni]

This PR adds support for RFC5424 structured data.

The is the same feature as submitted in #1 but since the author did not sign CLA, the implementation is new and not based on the same work.

Note that the tests do not pass until #51 is fixed, for example by applying #55 which was never merged #68.

---

Part of elastic/logstash#15236

[andsel]

Instead of using nil ad default value you could simply let undefined the default value, in that case the fields already gets nil value. nil values needs nil checks, I think that in this cas you could define as empty string ("") the default value, and no nil check is needed.

[tsaarni]

I think that in this cas you could define as empty string ("") the default value, and no nil check is needed.

I've used nil as a special value to avoid the need to evaluate the structured_data per every event, unless structured_data is provided by user. If provided by user, it may contain variables and every event should goes through event.sprintf() call

      sd = @structured_data.nil? ? "-" : event.sprintf(@structured_data)

If you think this optimization is not required and it is ok to call formatting for each event regardless, then I can set default to - which means no structured data according to the syslog spec.

[andsel]

You can check for empty string and use as default value the empty string. Empty string is a good practice to say "no value" which is more meaningful then nil. nil is risky because could always escape nil checks and result in runtime exceptions.
I would prefer the empty string.

[tsaarni]

Fixed!

[andsel]

Left a couple of nitpicks before a final check

[andsel]

This is not Ruby code, so no need for that highlighting:

Suggested change

	[source,ruby]
	["source",subs="attributes"]

[tsaarni]

Just to double-check: "source" should be in quotes?

I'm not that familiar with asciidoc and I did not see it used that way before. The doc did not seem to explicitly mention quoted element attributes.

[andsel]

If I recall correctly is indifferent, but looking the logstash-input-beats doc, the double quotes is used.

[andsel]

Please add a reference to this PR:

Suggested change

	- Added support for RFC5424 structured data.
	- Added support for RFC5424 structured data. [#67](https://github.com/logstash-plugins/logstash-output-syslog/pull/67)

[andsel]

LGTM

[andsel]

@tsaarni please rebase this PR to the main, so that it can grab the test fixes please 🙏

[andsel]

We keep all these syslog updates under the 3.0.6version, so probably you have a conflict in release notes, but just add the description of this under what's coming from the upstream :-)