<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">according to the syslog-ng
administrators guide, the section "Hard vs. soft macros" the hard
macros that can not be rewritten/changed are<br>
<br>
BSDTAG, CONTEXT_ID, DATE, DAY, FACILITY_NUM, FACILITY, FULLDATE,
HOUR, ISODATE, LEVEL_NUM, LEVEL, MIN, MONTH_ABBREV, MONTH_NAME,
MONTH, MONTH_WEEK, , PRIORITY, PRI, RCPTID, SDATA, SEC, SEQNUM,
SOURCEIP, STAMP, TAG, TAGS, TZOFFSET, TZ, UNIXTIME,
WEEK_DAY_ABBREV, WEEK_DAY_NAME, WEEK_DAY, WEEK, YEAR_DAY, YEAR<br>
<br>
and that includes the priority of a message.<br>
<br>
On 06/09/2017 12:10 PM, To Mitz wrote:<br>
</div>
<blockquote type="cite"
cite="mid:844574046.5665205.1497035424089@mail.yahoo.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div style="color:#000; background-color:#fff;
font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande,
sans-serif;font-size:13px">
<div id="yui_3_16_0_1_1497034921763_6943">Hi,</div>
<div id="yui_3_16_0_1_1497034921763_6944"><br>
</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_6945">I am trying
to use rewrite to change a message's PRIORITY. I am able to
change the HOST to "info" using:</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_6945"><br>
</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_6945"> <span
style="font-variant-ligatures: no-common-ligatures;
font-family: Menlo; font-size: 11px;"
id="yui_3_16_0_1_1497034921763_7008">rewrite
r_rewrite_set{set("info", value("HOST")
condition(filter(f_logstash)));};</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_6945"><span
style="font-variant-ligatures: no-common-ligatures;
font-family: Menlo; font-size: 11px;"><br>
</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7015">But, when I
try setting the PRIORITY to "info", using this:</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7015"><br>
</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7015"> <span
style="font-variant-ligatures: no-common-ligatures;
font-family: Menlo; font-size: 11px;"
id="yui_3_16_0_1_1497034921763_7060">rewrite
r_rewrite_set{set("info", value("PRIORITY")
condition(filter(f_logstash)));};</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_6945"><br>
</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7066">But, when I
try setting the PRIORITY to "info", using this:</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7067"><br
id="yui_3_16_0_1_1497034921763_7068">
</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7067">
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7103"><span
id="yui_3_16_0_1_1497034921763_7104">Error parsing rewrite
expression, syntax error, unexpected LL_NUMBER, expecting
LL_IDENTIFIER or LL_STRING in
/etc/syslog-ng/f_messages.conf at line 8, column 27:</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7103">
</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7131"><span
id="yui_3_16_0_1_1497034921763_7132">included from
/etc/syslog-ng.conf line 18, column 34</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7131">
</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7166"><span
id="yui_3_16_0_1_1497034921763_7167">rewrite
r_rewrite_set{set(3, value("PRIORITY")
condition(filter(f_logstash)));};</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7166">
</div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7190"><span
id="yui_3_16_0_1_1497034921763_7191">^</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7190"><span><br>
</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7190"><span><br>
</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7190"><span
id="yui_3_16_0_1_1497034921763_7203">Please advise on how
I can fix this.</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7190"><span><br>
</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7190"><span>Thanks.</span></div>
<div dir="ltr" id="yui_3_16_0_1_1497034921763_7190"><span><br>
</span></div>
<br>
</div>
</div>
</blockquote>
</body>
</html>