While implementing T257861, it was discovered that the host.name field was not being populated because tcpircbot does not gather that information. This issue has been worked around elsewhere for other producers.

The syslog_cee template injects timestamp, logsource, host, program, severity, and facility fields as string values.

For ECS-formatted logs:

1. the host field is an object.
2. timestamp often collides with the software-generated timestamp.
3. logsource, severity, facility are not ECS fields.

These conflicts have existed since we enabled @cee logs in rsyslog and became problematic at the adoption of ECS.

One possible solution is to namespace the rsyslog fields in the template. To preserve dashboards, this would require us to move the fields into the right place in logstash.

Questions to answer:

1. What fields are auto-added by the input plugin? The answer may well be "none" in kafka.
2. Any other fields added by rsyslog?