[syslog-ng] Changing message priority

[Scheidler, Balázs]

There's no mechanism to change the priority or facility of a message as of
now. If can be worked around by rewriting the syslog header before parsing
or on output.

The syntax error itself is caused by the fact the fact that the number
three in the set () operation is not quoted.

On Jun 9, 2017 21:14, "To Mitz" <atm613 at yahoo.com> wrote:

> Hi,
>
> I am trying to use rewrite to change a message's PRIORITY.  I am able to
> change the HOST to "info" using:
>
>   rewrite r_rewrite_set{set("info", value("HOST")
> condition(filter(f_logstash)));};
>
> But, when I try setting the PRIORITY to "info", using this:
>
>   rewrite r_rewrite_set{set("info", value("PRIORITY")
> condition(filter(f_logstash)));};
>
> But, when I try setting the PRIORITY to "info", using this:
>
> Error parsing rewrite expression, syntax error, unexpected LL_NUMBER,
> expecting LL_IDENTIFIER or LL_STRING in /etc/syslog-ng/f_messages.conf at
> line 8, column 27:
> included from /etc/syslog-ng.conf line 18, column 34
> rewrite r_rewrite_set{set(3, value("PRIORITY")
> condition(filter(f_logstash)));};
> ^
>
>
> Please advise on how I can fix this.
>
> Thanks.
>
>
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170615/a345609d/attachment.html>