5 Jul
2011
5 Jul
'11
9:27 p.m.
Care should be taken that $TAGS will expand to all tags, so only one tag should be on any message. AFAIK, syslog-ng automatically adds the id of the source (s_net_192 in the above example) to $TAGS, so you'll have at least two tags.
You're correct. Darn. The next best thing is beating this info somewhere into SDATA then.. -- |8]