[syslog-ng] Message Macros

[Faine, Mark R. (MSFC-IS40)[NICS]]

Is it possible to break up the $MESSAGE macro into smaller macros that constitute the entire message?  The reason I ask is that we tried this format in our destination:

template("${S_ISODATE} ${MESSAGE}\n")

However, we get two dates now, since I'm assuming one is part of the $MESSAGE macro, and we also lost the $HOST in our messages.

We just want the output to be exactly like it would be without specifying a template but with an ISO date, followed by the hostname/ip, and the rest of the message excluding the date.

Thanks,
-Mark


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200826/f6836e60/attachment-0001.html>