syslog-ng Open Source Edition 3.30 - Administration Guide

Replacing message parts

To replace a part of the log message, you have to:

• define a string or regular expression to find the text to replace

• define a string to replace the original text (macros can be used as well)

• select the field of the message that the rewrite rule should process

Substitution rules can operate on any soft macros, for example, MESSAGE, PROGRAM, or any user-defined macros created using parsers. You can also rewrite the structured-data fields of messages complying to the RFC5424 (IETF-syslog) message format.

Substitution rules use the following syntax:

rewrite <name_of_the_rule> {
    subst(
        "<string or regular expression to find>",
        "<replacement string>", value(<field name>), flags()
    );
};

The type() and flags() options are optional. The type() specifies the type of regular expression to use, while the flags() are the flags of the regular expressions. For details on regular expressions, see Regular expressions.

A single substitution rule can include multiple substitutions that are applied sequentially to the message. Note that rewriting rules must be included in the log statement to have any effect.

rewrite r_rewrite_subst{
    subst("IP", "IP-Address", value("MESSAGE"));
};

rewrite r_rewrite_subst{
    subst("IP", "IP-Address", value("MESSAGE"), flags("global"));
};

rewrite r_rewrite_subst{
    subst("IP", "IP-Address", value("MESSAGE"));
    subst("Address", "Addresses", value("MESSAGE"));
};

rewrite pseudonymize_ip_addresses_in_message {subst ("((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])[.]){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))", "$(sha1 $0)", value("MESSAGE"));};

Setting message fields to specific values

To set a field of the message to a specific value, you have to:

• define the string to include in the message, and

• select the field where it should be included.

You can set the value of available macros, for example, HOST, MESSAGE, PROGRAM, or any user-defined macros created using parsers (for details, see parser: Parse and segment structured messages and db-parser: Process message content with a pattern database (patterndb)). Note that the rewrite operation completely replaces any previous value of that field.

Use the following syntax:

rewrite <name_of_the_rule> {
    set("<string to include>", value(<field name>));
};

rewrite r_rewrite_set{
    set("myhost", value("HOST"));
};

rewrite r_rewrite_set{
    set("$MESSAGE suffix", value("MESSAGE"));
};

You can also use the following options in rewrite rules that use the set() operator.

rewrite <name_of_the_rule> {
    set("<string to include>", value(<field name>), on-error("fallback-to-string");
};

Setting severity with the set-severity() rewrite function

It is possible to configure the severity field with the set-severity() rewrite function. When configured, the set-severity() rewrite function will only rewrite the $SEVERITY field in the message to the first parameter value specified in the function.

rewrite <name_of_the_rule> {
    set-severity("severity string or number");
};

set-severity( "parameter1" );

rewrite {
    set-severity("info");
};

rewrite {
    set-severity("6");
};

rewrite {
    set-severity("${.json.severity}");
};

Setting the facility field with the set-facility() rewrite function

It is possible to set the facility field with the set-facility() rewrite function. When set, the set-facility() rewrite function will only rewrite the $PRIORITY field in the message to the first parameter value specified in the function.

log {
    source { system(); };
    if (program("postfix")) {
      rewrite { set-facility("mail"); };
    };
    destination { file("/var/log/mail.log"); };
    flags(flow-control);
};

set-facility( "parameter1" );

rewrite {
set-facility("info");
set-facility("6");
set-facility("${.json.severity}");};