You seem to want only the message part of the log entry. With syslog-ng, $MSG contains the program too, and if you want the message part only, you should try $MSGONLY in the template. That should do just what you want.
By the way, there's excellent documentation about syslog-ng macros, which explains the difference between $MSG and $MSGONLY at http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guid...
Thank you for the reply. I thought I'd RTFM'ed, but obviously not enough. It sounds like $MSGONLY is exactly what I need. -- Champ Clark III | Softwink, Inc | 800-538-9357 x 101 http://www.softwink.com GPG Key ID: 58A2A58F Key fingerprint = 7734 2A1C 007D 581E BDF7 6AD5 0F1F 655F 58A2 A58F If it wasn't for C, we'd be using BASI, PASAL and OBOL.