Set multiple message fields to specific values

The groupset() rewrite rule allows you to modify the value of multiple message fields at once, for example, to change the value of sensitive fields extracted using patterndb, or received in a JSON format. (If you want to modify the names of message fields, see map-value-pairs: Rename value-pairs to normalize logs.)

• The first parameter is the new value of the modified fields. This can be a simple string, a macro, or a template (which can include template functions as well).
• The second parameter (values()) specifies the fields to modify. You can explicitly list the macros or fields (a space-separated list with the values enclosed in double-quotes), or use wildcards and glob expressions to select multiple fields.
• Note that groupset() does not create new fields, it only modifies existing fields.
• You can refer to the old value of the field using the $_ macro. This is resolved to the value of the current field, and is available only in groupset() rules.

• You can set the type of the field. Where you can use of templates in set() and groupset(), you can use type-casting, and the type information is properly promoted. For details, see Specifying data types in value-pairs.

See also the related FilterX function set_fields(), which sets multiple keys of a dict. It differs from groupset(): it selects keys explicitly instead of by glob expression, has no equivalent of the $_ macro, and it can also create new keys.

Declaration

rewrite <name_of_the_rule> {
    groupset("<new-value-of-the-fields>", values("<field-name-or-glob>" ["<another-field-name-or-glob>"]));
};

Example: Using groupset rewrite rules

The following examples show how to change the values of multiple fields at the same time.

• Change the value of the HOST field to myhost.

      groupset ("myhost" values("HOST"))
  

• Change the value of the HOST and FULLHOST fields to myhost.

      groupset ("myhost" values("HOST" "FULLHOST"))
  

• Change the value of the HOST, FULLHOST and fields to lowercase.

      groupset ("$(lowercase "$_")" values("HOST" "FULLHOST"))
  

• Change the value of each field and macro that begins with .USER to nobody.

      groupset ("nobody" values(".USER.*"))
  

• Change the value of each field and macro that begins with .USER to its SHA-1 hash (truncated to 6 characters).

      groupset ("$(sha1 --length 6 $_)" values(".USER.*"))
  

Options

The groupset() rewrite rule has the following options.

<!-- This file is under the copyright of Axoflow, and licensed under Apache License 2.0, except for using the Axoflow and AxoSyslog trademarks. -->

condition()

Description: Applies the rewrite rule only to the messages that match the specified filter expression. Messages that don’t match the filter pass through the rule unmodified, and continue to the next element of the log path. You can use any filter expression here, and you can reference an existing filter with the filter() function. For details, see Conditional rewrites.

values()

Description: Specifies the fields to modify. You can list the fields explicitly as a space-separated list of double-quoted names, or select multiple fields with glob expressions, for example, values(".USER.*"). This option is mandatory. Note that groupset() only modifies existing fields, it doesn’t create new ones.