On a test machine, I've set up syslog-ng with a filter which looks like this :

filter filter1 { match(".+" VALUE ("MACRO")); };

I've tried many MACROS and it seems only a few of them are not empty (easy to spot using this regex). The most surprising is that several documented macros are empty : for instance, MSGHDR and MSG (MSG should be the same than MESSAGE, but looks like it's not).

Is it a bug ?

Thanks,