On 10/23/2017 02:05 PM, Mukund Sivaraman via RT wrote:
>
> This was previously implemented in:
>
> 4566.   [func]          Query logging now includes the ECS option if one
>                          was included in the query. [RT #44476]
>
> You should be able to try this in the 9.12.0 beta (and future 9.12.0
> stable release). It has not been backported to 9.11 and below as it
> updates the query log message.
>

    Thanks!  I'll have to download 9.12.x and do some testing with it 
(if for no other reason than to update my syslog daemon's named parsing 
(grin).

Brent