I think we should expand the beginning of this docstring to say:

This Module is a pipeline of correlation related methods used to validate and format incoming messages.  Entry points into the correlation pipeline have been implemented as asynchronous tasks.  There are 2 entry points, one for messages that are received from a syslog parser, and another entry point for messages posted to the http_log endpoint.

Case 1....