filebeat syslog input: missing log.source.address when message not parsed

[candlerb]

• Version: 7.3.0
• Operating System: Ubuntu 18.04.3
• Steps to Reproduce:

filebeat.inputs:
- type: syslog
  enabled: true
  protocol.udp:
    host: "localhost:5514"

output.console:
  enabled: true
  codec.json:
    pretty: true

Submit a message using nc in a format which is not parsable. The following example is a message from a Netgear switch, which has a spurious space after the <PRI>

echo -n "<13> Aug 16 12:25:24 10.12.255.2-1 TRAPMGR[53034492]: traputil.c(696) 135956 %% Link Up: g5." | nc -w0 -u localhost 5514

Result:

{
  "@timestamp": "2019-08-16T11:40:46.045Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "7.3.0",
    "truncated": false
  },
  "ecs": {
    "version": "1.0.1"
  },
  "host": {
    "name": "test1"
  },
  "message": "<13> Aug 16 12:25:24 10.12.255.2-1 TRAPMGR[53034492]: traputil.c(696) 135956 %% Link Up: g5.",
  "input": {
    "type": "syslog"
  },
  "agent": {
    "type": "filebeat",
    "ephemeral_id": "1dd71572-8757-4810-8840-f7d9e75eace5",
    "hostname": "test1",
    "id": "5ebedd24-b8a6-4445-bd8a-055a026404e3",
    "version": "7.3.0"
  }
}

The message has been captured, and it has not been further parsed (which is fine).

However, the JSON is missing the log.source.address field which is normally present. If I resend the message without the spurious space, then I get:

  "log": {
    "source": {
      "address": "127.0.0.1:32818"
    }
  },

This means that with such badly-formatted messages, the information about where they originated from has been lost, making it very hard to trace them back to source.