In Logging 6 was implemented a new format for when the output is syslog. This change is a breaking change for those having any automatism for parsing the logs received in a syslog server.

This new format is not documented in the Release Notes and not documented in any place inside the Red Hat Logging documentation not allowing to be considered it and preparing before migrating from Logging 5 to Logging 6.

Then, it's expected to have this change mentioned in the Release Notes for Logging 6.y and at the same time documented what's the new format available. The format is visible in:

https://github.com/openshift/cluster-logging-operator/blob/release-6.2/docs/features/logforwarding/outputs/syslog-forwarding.adoc#rfc5424