This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Set message fields to specific values

To set a field of the message to a specific value, you have to:

  • define the string to include in the message, and
  • select the field where it should be included.

  • You can set the type of the field. Where you can use of templates in set() and groupset(), you can use type-casting, and the type information is properly promoted. For details, see Specifying data types in value-pairs.

You can set the value of available macros, for example, HOST, MESSAGE, PROGRAM, or any user-defined macros created using parsers (for details, see parser: Parse and segment structured messages and db-parser: Process message content with a pattern database (patterndb)). Note that the rewrite operation completely replaces any previous value of that field.

See also the equivalent FilterX operation, assigning a value.

Use the following syntax:

Declaration

   rewrite <name_of_the_rule> {
        set("<string to include>", value(<field name>));
    };

Example: Set message fields to a particular value

The following example sets the HOST field of the message to myhost.

   rewrite r_rewrite_set{
        set("myhost", value("HOST"));
    };

The following example appends the “suffix” string to the MESSAGE field:

   rewrite r_rewrite_set{
        set("$MESSAGE suffix", value("MESSAGE"));
    };

For details on rewriting SDATA fields, see Create custom SDATA fields.

Options

The set() rewrite rule has the following options. In addition to condition(), internal(), and value(), set() accepts the template options listed below, which control how AxoSyslog expands the template in its first argument.

   rewrite <name_of_the_rule> {
        set("<string to include>", value(<field name>), on-error("fallback-to-string"));
    };

<!-- This file is under the copyright of Axoflow, and licensed under Apache License 2.0, except for using the Axoflow and AxoSyslog trademarks. -->

condition()
Type: filter expression
Default: N/A

Description: Applies the rewrite rule only to the messages that match the specified filter expression. Messages that don’t match the filter pass through the rule unmodified, and continue to the next element of the log path. You can use any filter expression here, and you can reference an existing filter with the filter() function. For details, see Conditional rewrites.

frac-digits()
Type: number
Default: 0

Description: The number of digits that AxoSyslog stores when it expands a timestamp macro with fractions of a second. Overrides the global frac-digits() option for this rule.

internal()
Accepted values: yes, no
Default: no

Description: Marks this pipeline element as internal. Elements marked as internal() are treated as an implementation detail, so for example statistics of the given pipe are available only on higher stats level. This option is mainly useful for developers or when writing SCL blocks and integrations.

local-time-zone()
Type: name of the timezone, or the timezone offset
Default: The local timezone.

Description: Sets the timezone that AxoSyslog uses when it expands a timestamp macro as a local time.

<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

The timezone can be specified by using the name, for example, time-zone("Europe/Budapest")), or as the timezone offset in +/-HH:MM format, for example, +01:00). On Linux and UNIX platforms, the valid timezone names are listed under the /usr/share/zoneinfo directory.

on-error()

Type: One of: drop-message, drop-property, fallback-to-string, silently-drop-message, silently-drop-property, silently-fallback-to-string
Default: Use the global setting (which defaults to drop-message) 
<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

Description: Controls what happens when type-casting fails and AxoSyslog cannot convert some data to the specified type. By default, AxoSyslog drops the entire message and logs the error. Currently the value-pairs() option uses the settings of on-error().

  • drop-message: Drop the entire message and log an error message to the internal() source. This is the default behavior of AxoSyslog.
  • drop-property: Omit the affected property (macro, template, or message-field) from the log message and log an error message to the internal() source.
  • fallback-to-string: Convert the property to string and log an error message to the internal() source.
  • silently-drop-message: Drop the entire message silently, without logging the error.
  • silently-drop-property: Omit the affected property (macro, template, or message-field) silently, without logging the error.
  • silently-fallback-to-string: Convert the property to string silently, without logging the error.

send-time-zone()
Type: name of the timezone, or the timezone offset
Default: The local timezone.

Description: Sets the timezone that AxoSyslog uses when it expands a timestamp macro. The time-zone() option is an alias of send-time-zone().

<!-- DISCLAIMER: This file is based on the syslog-ng Open Source Edition documentation https://github.com/balabit/syslog-ng-ose-guides/commit/2f4a52ee61d1ea9ad27cb4f3168b95408fddfdf2 and is used under the terms of The syslog-ng Open Source Edition Documentation License. The file has been modified by Axoflow. -->

The timezone can be specified by using the name, for example, time-zone("Europe/Budapest")), or as the timezone offset in +/-HH:MM format, for example, +01:00). On Linux and UNIX platforms, the valid timezone names are listed under the /usr/share/zoneinfo directory.

template-escape()
Type: yes, no
Default: no

Description: Turns on escaping for the ', ", and backspace characters in the expanded value.

time-zone()
Type: name of the timezone, or the timezone offset
Default: The local timezone.

Description: Alias of send-time-zone().

ts-format()
Type: rfc3164, bsd, rfc3339, iso
Default: rfc3164

Description: Overrides the global ts-format() option for the timestamp macros that this rule expands.

<!-- This file is under the copyright of Axoflow, and licensed under Apache License 2.0, except for using the Axoflow and AxoSyslog trademarks. -->

value()
Type: name of a message field
Default: MESSAGE

Description: Selects the field of the message that the rewrite rule modifies. If you don’t set it, the rule operates on the MESSAGE field.

Write the name of the field without the $ prefix, for example, value("HOST"), not value("$HOST"). The $ prefix is only needed in templates, and AxoSyslog logs a warning if you use it here. You cannot set a hard macro in the value() option, AxoSyslog rejects the configuration with an error.