Github user ctramnitz commented on the issue:
https://github.com/apache/metron/pull/579
No it's not a requirement. The parser will continue to work the same way as
it did before if you feed it a full syslog line including header. (Which
wouldn't produce a valid domain field, but thats exactly the same behavior as
before)---
