Hi, No promises, but I'd definitely try `subst()` with a regexp and `\L` which is supposed to lowercase Cheers -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20150923/0db33f4d/attachment.htm