It is possible to configure the severity field with the set-severity() rewrite function. When configured, the set-severity() rewrite function will only rewrite the $SEVERITY field in the message to the first parameter value specified in the function.
NOTE: If the parameter value is not a valid parameter value, the function ignores it and sends a debug message, but the syslog-ng Open Source Edition (syslog-ng OSE) application still sends the message.
Declaration
rewrite <name_of_the_rule> {
set-severity("severity string or number");
};
Parameters
The set-severity() rewrite function has a single, mandatory parameter that can be defined as follows:
set-severity( "parameter1" );
Accepted values
The set-severity() rewrite function accepts the following values:
- numeric strings: [0-7]
- named values: emerg, emergency, panic, alert, crit, critical, err, error, warning, warn, notice, info, informational, debug
Example usage for the set-severity() rewrite function
The following examples can be used in production for the set-severity() rewrite function.
Example using string:
rewrite {
set-severity("info");
};
Example using numeric string:
rewrite {
set-severity("6");
};
Example using template:
rewrite {
set-severity("${.json.severity}");
};
It is possible to set the facility field with the set-facility() rewrite function. When set, the set-facility() rewrite function will only rewrite the $PRIORITY field in the message to the first parameter value specified in the function.
NOTE: If the parameter value is not a valid parameter value, the function ignores it and sends a debug message, but the application still sends the message.
Declaration
log {
source { system(); };
if (program("postfix")) {
rewrite { set-facility("mail"); };
};
destination { file("/var/log/mail.log"); };
flags(flow-control);
};
Parameters
The set-facility() rewrite function has a single, mandatory parameter that can be defined as follows:
set-facility( "parameter1" );
Accepted values
The set-facility() rewrite function accepts the following values:
- numeric strings: [0-7]
- named values: emerg, emergency, panic, alert, crit, critical, err, error, warning, warn, notice, info, informational, debug
Example usage for the set-facility() rewrite function
The following example can be used in production for the set-facility() rewrite function.
rewrite {
set-facility("info");
set-facility("6");
set-facility("${.json.severity}");};
You can set the PRI value of a BSD or IETF syslog message with the set-pri() rewrite function by specifying a template string. This is useful, for example, if incoming messages do not have a PRI value specified by default, but a PRI value is required for filtering purposes.
When configured, the set-pri() function will only rewrite the PRI value of the message field.
NOTE: If the specified parameter value is not a valid value, the function ignores it and sends a debug message. However, the syslog-ng Open Source Edition (syslog-ng OSE) application will still send the message.
Declaration
rewrite <rule-name> {
set-pri("template-string");
};
Parameters
The set-pri() rewrite function expects a template string as its only parameter, for example:
Accepted values
The template string specified for the set-pri() rewrite function must expand to a natural number in the interval of 0–1023, inclusive. This means that if you, for example, extract the value from a syslog <PRI> header (such as <42>), then you need to remove the opening and closing brackets (< >) in the specified template string.
Example: Temporarily raising the priority of an application
In the following example, the set-pri() rewrite function is used to temporarily raise the priority of the application myprogram:
log {
source { system(); };
if (program("myprogram")){
rewrite { set-pri("92"); };
};
destination { file("/var/log/mail.log"); };
flags(flow-control);
}
Example: Changing the priority of an application log message in JSON format
In the following example, an application sends log messages in the following JSON format:
{
"time": "2003-10-11T22:14:15.003Z",
"host": "mymachine",
"priority": "165",
"message": "An application event log entry."
}
You can parse these logs with the JSON parser function:
{
parser p_json {
json-parser (prefix(".json."));
}
As the application message contains a valid priority field, you can use the set-pri() rewrite function to modify the priority of the message:
set-pri("$.json.priority");
You can unset macros or fields of the message, including any user-defined macros created using parsers (for details, see parser: Parse and segment structured messages and db-parser: Process message content with a pattern database (patterndb)). Note that the unset operation completely deletes any previous value of the field that you apply it on.
Use the following syntax:
Declaration:
rewrite <name_of_the_rule> {
unset(value("<field-name>"));
};
Example: Unsetting a message field
The following example unsets the HOST field of the message.
rewrite r_rewrite_unset{
unset(value("HOST"));
};
To unset a group of fields, you can use the groupunset() rewrite rule.
Declaration:
rewrite <name_of_the_rule> {
groupunset(values("<expression-for-field-names>"));
};
Example: Unsetting a group of fields
The following rule clears all SDATA fields:
rewrite r_rewrite_unset_SDATA{
groupunset(values(".SDATA.*"));
};
