whitelist CEF fields, correct syslog facility, unicode and lowercase the keys