Unset message fields
You can unset macros or fields of the message, including any user-defined macros created using parsers (for details, see parser: Parse and segment structured messages and db-parser: Process message content with a pattern database (patterndb)). Note that the unset operation completely deletes any previous value of the field that you apply it on.
Unset a field
Use the following syntax:
rewrite <name_of_the_rule> {
unset(value("<field-name>"));
};
Example: Unset a message field
The following example unsets the HOST field of the message.
rewrite r_rewrite_unset{
unset(value("HOST"));
};
If you’re using FilterX, see also the equivalent unset() function.
Unset group
To unset a group of fields, you can use the groupunset() rewrite rule.
rewrite <name_of_the_rule> {
groupunset(values("<expression-for-field-names>"));
};
Example: Unset a group of fields
The following rule clears all SDATA fields:
rewrite r_rewrite_unset_SDATA{
groupunset(values(".SDATA.*"));
};
Options
The unset() rewrite rule has the following options.
<!-- This file is under the copyright of Axoflow, and licensed under Apache License 2.0, except for using the Axoflow and AxoSyslog trademarks. -->
condition()
| Type: | filter expression |
| Default: | N/A |
Description: Applies the rewrite rule only to the messages that match the specified filter expression. Messages that don’t match the filter pass through the rule unmodified, and continue to the next element of the log path. You can use any filter expression here, and you can reference an existing filter with the filter() function. For details, see Conditional rewrites.
internal()
| Accepted values: | yes, no |
| Default: | no |
Description: Marks this pipeline element as internal. Elements marked as internal() are treated as an implementation detail, so for example statistics of the given pipe are available only on higher stats level. This option is mainly useful for developers or when writing SCL blocks and integrations.
<!-- This file is under the copyright of Axoflow, and licensed under Apache License 2.0, except for using the Axoflow and AxoSyslog trademarks. -->
value()
| Type: | name of a message field |
| Default: | MESSAGE |
Description: Selects the field of the message that the rewrite rule modifies. If you don’t set it, the rule operates on the MESSAGE field.
Write the name of the field without the $ prefix, for example, value("HOST"), not value("$HOST"). The $ prefix is only needed in templates, and AxoSyslog logs a warning if you use it here. You cannot set a hard macro in the value() option, AxoSyslog rejects the configuration with an error.
The groupunset() rewrite rule has the condition() option described above, and the following option.
values()
| Type: | list of field names or globs |
| Default: | N/A |
Description: Specifies the fields to unset. You can list the fields explicitly as a space-separated list of double-quoted names, or select multiple fields with glob expressions, for example, values(".SDATA.*"). This option is mandatory.