Function find_cef_start 

pub fn find_cef_start(input: &str) -> Option<usize>

Find the byte offset of "CEF:" in the input, if present.

Useful for stripping a syslog prefix before calling parse.