Hello,
You could use rewrite rule for this, but in fact macro expansion is capable to solve your problem: `${.cake:-no-cake}` where if `.cake` exists uses its value, otherwise the string after `:-`
@version: 3.20
log {
source { stdin(flags(no-parse)); };
parser { kv-parser(prefix(".")); };
rewrite { set("[${.cake:-no-cake}]" value("MESSAGE")); };
#destination { file("/dev/stdout" template("${.cake:-undefined}\n")); };
destination { file("/dev/stdout"); };
};
As the result you could either use rewrite/set to add the value to the msg itself (other destination/parser/filter could use it), or you could just use it directly in the destination macro expansion.
It really depends on your setup which place you should prefer.
--
Kokan