according to the syslog-ng
administrators guide, the section "Hard vs. soft macros" the hard
macros that can not be rewritten/changed are
BSDTAG, CONTEXT_ID, DATE, DAY, FACILITY_NUM, FACILITY, FULLDATE,
HOUR, ISODATE, LEVEL_NUM, LEVEL, MIN, MONTH_ABBREV, MONTH_NAME,
MONTH, MONTH_WEEK, , PRIORITY, PRI, RCPTID, SDATA, SEC, SEQNUM,
SOURCEIP, STAMP, TAG, TAGS, TZOFFSET, TZ, UNIXTIME,
WEEK_DAY_ABBREV, WEEK_DAY_NAME, WEEK_DAY, WEEK, YEAR_DAY, YEAR
and that includes the priority of a message.
On 06/09/2017 12:10 PM, To Mitz wrote:
Hi,
I am trying
to use rewrite to change a message's PRIORITY. I am able to
change the HOST to "info" using:
rewrite
r_rewrite_set{set("info", value("HOST")
condition(filter(f_logstash)));};
But, when I
try setting the PRIORITY to "info", using this:
rewrite
r_rewrite_set{set("info", value("PRIORITY")
condition(filter(f_logstash)));};
But, when I
try setting the PRIORITY to "info", using this:
Error parsing rewrite
expression, syntax error, unexpected LL_NUMBER, expecting
LL_IDENTIFIER or LL_STRING in
/etc/syslog-ng/f_messages.conf at line 8, column 27:
included from
/etc/syslog-ng.conf line 18, column 34
rewrite
r_rewrite_set{set(3, value("PRIORITY")
condition(filter(f_logstash)));};
^
Please advise on how
I can fix this.
Thanks.