GRAYLOG - Chapter 5, Exercise 2 Solution
==========================================================
Why gl2_processing_duration_ms Is a Different Kind of Field

PROBLEM
-------
Explain, using this chapter's own material, why
gl2_processing_duration_ms is worth treating differently from the other
six fields in this chapter's own table when reasoning about where a
value actually came from.

SOLUTION
--------
This chapter's own tip-box established that every field in the table
except gl2_processing_duration_ms was written by the APPLICATION itself
as part of its own real log message - requestMethod, requestPath,
requestHost, requestIp, status/requestStatus, and responseSize are all
values the service's own code chose to log.

gl2_processing_duration_ms is different: the gl2_ prefix is Graylog's
own reserved namespace for metadata Graylog ITSELF attaches to a message
during processing - it did not come from the application's own log
line at all.

ANSWER: gl2_processing_duration_ms is worth treating differently because
it comes from Graylog's own internal processing metadata (the gl2_
prefix), not from the application's own logged output like the other six
fields. It's still genuinely useful, but its source is Graylog itself,
not the service being investigated.

----
WHY THIS WORKS AS AN ANSWER

This is a direct restatement of this chapter's own tip-box distinction.
Knowing which fields come from the application versus from Graylog
itself matters practically too - if a service's own logging changes or
breaks, the application-sourced fields could be affected, while a gl2_-
prefixed field would keep working regardless, since Graylog generates it
independently of what the application itself chose to log.