[syslog-ng] [Bug 88] document that rewrite can create new name-value pairs

bugzilla at bugzilla.balabit.com bugzilla at bugzilla.balabit.com
Thu Jul 1 16:49:34 CEST 2010


https://bugzilla.balabit.com/show_bug.cgi?id=88





--- Comment #6 from Alexander Pogrebnyak <alex-pub.balabit at reflexion.net>  2010-07-01 16:49:34 ---
(In reply to comment #5)
Thanks again for speedy reply!  Below is proof read of your documentation changes.
> I've added the following example to the existing rewrite set examples, and also added a note about fields that cannot be rewritten:
> 
> It is also possible to use set the value of a field that does not exist yet, and create a new name-value pair that is associated with
> the message. The following example created the MODIFIED field and sets its value to yes. If you use the $MODIFIED macro
> in a template or SQL table, its value will be yes for every message that was processed with this rewrite rule, and empty for
> every other message.
> rewrite r_rewrite_set{set("yes", value("MODIFIED"));};
> 
> 
> It will be available in the next edition of the adminguide.
> 
> Robert
> 

It is also possible to set the value of a field that does not exist yet, and create a new name-value pair that is associated with
the message. The following example creates the MODIFIED field and sets its value to 'yes'. If you use the $MODIFIED macro
in a template or SQL table, its value will be 'yes' for every message that was processed with this rewrite rule, and empty for
every other message.
rewrite r_rewrite_set{set("yes", value("MODIFIED"));};

-Alex


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.


More information about the syslog-ng mailing list