Constant RAW_MESSAGE_COLUMN 

const RAW_MESSAGE_COLUMN: &str = "message";

Column holding the verbatim raw body on /raw (Splunk’s _raw). Named message to avoid clashing with /event’s event column (whose shape varies by client: string vs identity-flattened object).