syslog-ng Premium Edition 7.0.19 - Administration Guide

Unsetting message fields

You can unset a macro or a field of the message, including any user-defined macros created using parsers (for details, see parser: Parse and segment structured messages and Processing message content with a pattern database). Hard macros cannot be modified. For details on hard and soft macros, see Hard versus soft macros). Note that the unset operation completely deletes any previous value of the field that you apply it on. Use the following syntax:

Declaration

rewrite <name_of_the_rule> {
    unset(value("<field name>"));
};

rewrite r_rewrite_unset{unset(value("HOST"));};

To unset a group of fields, you can use the groupunset() rewrite rule.

Declaration

rewrite <name_of_the_rule> {
    groupunset(values("<expression-for-field-names>"));
};

rewrite r_rewrite_unset_SDATA{ groupunset(values(".SDATA.*"));};