Rename message fields
If you want to change the name of a field of a message, you can use rename() rewrite rules. This can be also achieved via using set() and unset() but those require extra conditions and two operation instead of one.
The rename() rewrite rule uses positional arguments and they are both required. It supports condition rewrite. For more information, see Conditional rewrites.
See also the related FilterX function move(). Note that rename() does nothing if the source field is missing, while move() fails in that case.
Declaration
rewrite r_rewrite_rename {
rename("<string1>" "<string2>");
};
Example usage for the rename() rewrite function
The following example renames the .app.name into .container if the .app.name exists. Otherwise, it does nothing.
rewrite r_rewrite_rename {
rename(".app.name" ".container");
};
Options
The rename() rewrite rule has the following option.
<!-- This file is under the copyright of Axoflow, and licensed under Apache License 2.0, except for using the Axoflow and AxoSyslog trademarks. -->
condition()
| Type: | filter expression |
| Default: | N/A |
Description: Applies the rewrite rule only to the messages that match the specified filter expression. Messages that don’t match the filter pass through the rule unmodified, and continue to the next element of the log path. You can use any filter expression here, and you can reference an existing filter with the filter() function. For details, see Conditional rewrites.