Hi Dave,
> rewrite r_rewrite_4624_2 { subst("interactive", "QuackApple",
> value("MSGONLY"));};
I'm using something similar, but am using the type and flags options:
rewrite r_use_basename {
subst(
"/var/log/apache2/",
"",
value(".SDATA.file at 18372.4.name")
type("string")
flags("prefix")
);
};