Hi Dave, > rewrite r_rewrite_4624_2 { subst("interactive", "QuackApple", > value("MSGONLY"));}; I'm using something similar, but am using the type and flags options: rewrite r_use_basename { subst( "/var/log/apache2/", "", value(".SDATA.file at 18372.4.name") type("string") flags("prefix") ); };