[syslog-ng] Rewriting CEF messages

[carlopmart]

Hi all,

  I am trying to rewrite CEF messages that arrives to a syslog-ng 
instance. I am using the following rewrite rule:

rewrite r_cef_logs { set("mydevice_logs", value("PROGRAM") 
condition(message("Device"))); };

Test message is:

CEF:0|Device|Firewall|0|....

  What am I doing wrong??

-- 
CL Martinez
carlopmart {at} gmail {d0t} com