There's no mechanism to change the priority or facility of a message as of now. If can be worked around by rewriting the syslog header before parsing or on output.

The syntax error itself is caused by the fact the fact that the number three in the set () operation is not quoted.

On Jun 9, 2017 21:14, "To Mitz" <atm613@yahoo.com> wrote:

Hi,

I am trying to use rewrite to change a message's PRIORITY. I am able to change the HOST to "info" using:

rewrite r_rewrite_set{set("info", value("HOST") condition(filter(f_logstash)));};

But, when I try setting the PRIORITY to "info", using this:

rewrite r_rewrite_set{set("info", value("PRIORITY") condition(filter(f_logstash)));};

But, when I try setting the PRIORITY to "info", using this:

Error parsing rewrite expression, syntax error, unexpected LL_NUMBER, expecting LL_IDENTIFIER or LL_STRING in /etc/syslog-ng/f_messages.conf at line 8, column 27:

included from /etc/syslog-ng.conf line 18, column 34

rewrite r_rewrite_set{set(3, value("PRIORITY") condition(filter(f_logstash)));};

^

Please advise on how I can fix this.

Thanks.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq