GRAYLOG - Chapter 2, Exercise 2 Solution
==========================================================
Finding the One Field That's Always Present

PROBLEM
-------
A query scoped by service and account returns nothing at all, and you
suspect the service in question never populates the account field for
this particular log line. Using this chapter's own material, name the
one field that should still be usable to identify where the message
came from.

SOLUTION
--------
This chapter's own compare-table explicitly marked three of the four
core scoping fields as NOT always present: service is populated per
service (but not universal), account is mainly populated on the
integration/RMS platform specifically, and daxtraResource is
infrastructure-dependent. Only one field in the table was marked as
always present regardless of which service wrote the message: source.

ANSWER: source - the hostname or container ID - is the one field this
chapter identified as always present on every message, making it the
right fallback to use when account (or any other more specific field)
isn't populated for a given log line.

----
WHY THIS WORKS AS AN ANSWER

This is a direct lookup against the chapter's own real compare-table,
which was built specifically to make this exact question answerable at
a glance - source's own defining real property, called out explicitly
in its own section, is that it's "always present on every message,
regardless of which service produced it or whether that service
bothered to populate the more specific fields."