Build structured data with explicit boundaries
03Structured data adds named elements and quoted parameter values. Brackets mark each element; an identifier names its meaning. Multiple elements are adjacent, without spaces between them.
Separate invalid example repeats example@32473 as two elements. The second SD-ID violates MUST NOT repeat; this is different from permitted repeated parameters inside one element.
Source for this drawing: RFC 5424 · Read RFC section 6.3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Escape the value’s syntax characters, and keep element identity distinct from parameter repetition.
- With zero elements STRUCTURED-DATA MUST be -. Otherwise it contains one or more [SD-ID parameters] elements. SD-ID is case-sensitive and MUST NOT repeat in one message. Elements follow one another with no SP between them (§§6.3/6.3.2).
- SD-NAME is 1–32 printable ASCII characters excluding =, SP, ], and double quote. Parameter names are case-sensitive. Names without @ require IANA registration; private element IDs use name@private-enterprise-number. 32473 is reserved for documentation, not a vendor’s real deployment (§6.3.2).
- PARAM-VALUE MUST use UTF-8; shortest-form sequences MUST be accepted, invalid/non-shortest UTF-8 MUST NOT be interpreted. Inside the value, double quote, backslash and ] MUST be escaped as backslash-quote, double-backslash and backslash-] (§6.3.3).
- An unrecognized escape such as backslash-q MUST remain an ordinary backslash plus q; it MUST NOT be silently removed. An SD-PARAM MAY repeat within one element, unlike duplicate SD-ID elements (§6.3.3).
- A collector MAY ignore malformed structured-data elements. A relay MUST forward malformed STRUCTURED-DATA without alteration (§6.3). This distinction does not make malformed syntax valid or authenticate the fields.
Examples show structured-data fragments, not full syslog messages. example@32473 is fictional documentation scope. Reported erratum6927 is not a verified replacement for the published SD-NAME grammar.
Read the RFC section ↗