Telegraf Error in Syslog Plugin when receiving a Syslog CEF

Hello Folks,

I got the following error in Influx's chronograf when the Syslog message being received is in CEF (Common Event Format). Is there any available resolution to for this specific telegraf plugins?

E! [inputs.syslog] Error in plugin: expecting an app-name (from 1 to max 48 US-ASCII characters) or a nil value [col 51

This is what the Syslog format/message looks like:

Nov 29 11:30:29 172.xx.x.x CEF:0|XYPRO|NONSTOP|XMA|OBJ-ACCESS-PASS|OBJECT-ACCESS-SUCCESS-SFG|4|cs3= 000002F2F5D8CFCEFB67 start= N end= N cs4= sproc= \xxx.$APNI5 ,0,665 spid= filePath= \xxx.xxxx.PRDAOBJ.NMIPCT src= sourceDnsDomain= dst= dhost= \xxx cs2= $xxxxx.SAFE deviceCustomDate1= 2021-11-29 03:30:17.578402 rt= 2021-11-29 11:30:17.578402 externalId= 000000001 outcome= 1 cs6= N / N cn1= A deviceFacility= SAFEGUARD suid= 190 , 001 duid= , suser= xxxx.xxx shost= \PN1 duser= fileType= DISKFILE fname= $xxxx.PRDAEVDB.SWAPUSE act= READ cs5= \xxx.$ZPTY.#ZWN0014 cat= 51 reason= 450 cs1= msg= Granted Read to Diskfile $xxxx.xxxxxxxx.SWAPUSE cn1Label=ALERTEDcs1Label=Rulenamecs2Label=ProductLocationcs3Label=SessionIDcs4Label=SessionNamecs5Label=Terminalcs6Label=Test/Warn#015

Start with the inputs.syslog plugin and reproduce the error using the supplied CEF-formatted Syslog message. Trace why the parser rejects the app-name at the reported column and determine the expected handling for this message format. Done means the plugin accepts the CEF message without the reported error and preserves existing Syslog behavior.

Written by the indexing model from the issue text.