<div dir="auto">There's no mechanism to change the priority or facility of a message as of now. If can be worked around by rewriting the syslog header before parsing or on output.<div dir="auto"><br></div><div dir="auto">The syntax error itself is caused by the fact the fact that the number three in the set () operation is not quoted.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Jun 9, 2017 21:14, "To Mitz" <<a href="mailto:atm613@yahoo.com">atm613@yahoo.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="color:#000;background-color:#fff;font-family:Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif;font-size:13px"><div id="m_-2932641971207982894yui_3_16_0_1_1497034921763_6943">Hi,</div><div id="m_-2932641971207982894yui_3_16_0_1_1497034921763_6944"><br></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_6945">I am trying to use rewrite to change a message's PRIORITY. I am able to change the HOST to "info" using:</div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_6945"><br></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_6945"> <span style="font-variant-ligatures:no-common-ligatures;font-family:Menlo;font-size:11px" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7008">rewrite r_rewrite_set{set("info", value("HOST") condition(filter(f_logstash)))<wbr>;};</span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_6945"><span style="font-variant-ligatures:no-common-ligatures;font-family:Menlo;font-size:11px"><br></span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7015">But, when I try setting the PRIORITY to "info", using this:</div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7015"><br></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7015"> <span style="font-variant-ligatures:no-common-ligatures;font-family:Menlo;font-size:11px" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7060">rewrite r_rewrite_set{set("info", value("PRIORITY") condition(filter(f_logstash)))<wbr>;};</span></div>
<div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_6945"><br></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7066">But, when I try setting the PRIORITY to "info", using this:</div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7067"><br id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7068"></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7067">
<div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7103"><span id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7104">Error parsing rewrite expression, syntax error, unexpected LL_NUMBER, expecting LL_IDENTIFIER or LL_STRING in /etc/syslog-ng/f_messages.conf at line 8, column 27:</span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7103">
</div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7131"><span id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7132">included from /etc/syslog-ng.conf line 18, column 34</span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7131">
</div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7166"><span id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7167">rewrite r_rewrite_set{set(3, value("PRIORITY") condition(filter(f_logstash)))<wbr>;};</span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7166">
</div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7190"><span id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7191">^</span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7190"><span><br></span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7190"><span><br></span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7190"><span id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7203">Please advise on how I can fix this.</span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7190"><span><br></span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7190"><span>Thanks.</span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7190"><span><br></span></div><div dir="ltr" id="m_-2932641971207982894yui_3_16_0_1_1497034921763_7190"><span><br></span></div></div></div></div><br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/">https://lists.balabit.hu/</a><wbr>mailman/listinfo/syslog-ng<br>
Documentation: <a href="http://www.balabit.com/">http://www.balabit.com/</a><wbr>support/documentation/?<wbr>product=syslog-ng<br>
FAQ: <a href="http://www.balabit.com/wiki/">http://www.balabit.com/wiki/</a><wbr>syslog-ng-faq<br>
<br>
<br></blockquote></div></div>