Rewrite
Rewrite filters can be used to modify record contents. Logging operator currently supports the following rewrite functions:
Note: All rewrite functions support an optional
condition
which has the same syntax as the match filter.
For details on how rewrite rules work in syslog-ng, see the documentation of the AxoSyslog syslog-ng distribution.
Group unset
The group_unset
function removes from the record a group of fields matching a pattern.
For details, see the documentation of the AxoSyslog syslog-ng distribution.
Rename
The rename
function changes the name of an existing field name.
For details, see the documentation of the AxoSyslog syslog-ng distribution.
Set
The set
function sets the value of a field.
For details, see the documentation of the AxoSyslog syslog-ng distribution.
Substitute (subst)
The subst
function replaces parts of a field with a replacement value based on a pattern.
The function also supports the type
and flags
fields for specifying pattern type and flags as described in the match expression regexp function.
For details, see the documentation of the AxoSyslog syslog-ng distribution.
Unset
You can unset macros or fields of the message.
Note: Unsetting a field completely deletes any previous value of the field.
For details, see the documentation of the AxoSyslog syslog-ng distribution.
Configuration
RewriteConfig
group_unset (*GroupUnsetConfig, optional)
rename (*RenameConfig, optional)
set (*SetConfig, optional)
subst (*SubstituteConfig, optional)
unset (*UnsetConfig, optional)
RenameConfig
For details, see the documentation of the AxoSyslog syslog-ng distribution.
condition (*MatchExpr, optional)
newName (string, required)
oldName (string, required)
SetConfig
For details, see the documentation of the AxoSyslog syslog-ng distribution.
condition (*MatchExpr, optional)
field (string, required)
value (string, required)
SubstituteConfig
For details, see the documentation of the AxoSyslog syslog-ng distribution.
condition (*MatchExpr, optional)
field (string, required)
flags ([]string, optional)
pattern (string, required)
replace (string, required)
type (string, optional)
UnsetConfig
For details, see the documentation of the AxoSyslog syslog-ng distribution.
condition (*MatchExpr, optional)
field (string, required)
GroupUnsetConfig
For details, see the documentation of the AxoSyslog syslog-ng distribution.