----- Original message -----
OK, from what Balazs writes below I guess it is not possible to use the parserdb functionality on the "$HOST $PROGRAM" contents.
Can someone confirm this is the case? If it can be done, a quick pointer please.
If it can not be done, but I want to, how can I do it?
rewrite { set("$MSG" value("orig.message")); set("$HOST($PROGRAM)" value("MESSAGE")); } parser(pattern_host_program); rewrite { set("$orig.message" value("MESSAGE")); set("" value("orig.message")); } parser(pattern_message);
this one should work, except for one thing. Values with dots in their name has to be enclosed by braces. eg. ${orig.message} but I'd really add the template option, that's much easier.
... all of my filters, log statements etc.