# Set multiple message fields to specific values

The `groupset()` rewrite rule allows you to modify the value of multiple message fields at once, for example, to change the value of sensitive fields extracted using patterndb, or received in a JSON format. (If you want to modify the names of message fields, see [map-value-pairs: Rename value-pairs to normalize logs](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/parser-map-value-pairs/index.md).)

  * The first parameter is the new value of the modified fields. This can be a simple string, a macro, or a template (which can include template functions as well).
  * The second parameter (`values()`) specifies the fields to modify. You can explicitly list the macros or fields (a space-separated list with the values enclosed in double-quotes), or use wildcards and glob expressions to select multiple fields.
  * Note that `groupset()` does not create new fields, it only modifies existing fields.
  * You can refer to the old value of the field using the `$_` macro. This is resolved to the value of the current field, and is available only in `groupset()` rules.
  * You can set the type of the field. Where you can use of templates in `set()` and `groupset()`, you can use type-casting, and the type information is properly promoted. For details, see [Specifying data types in value-pairs](../../../docs/axosyslog-core/4.26/chapter-concepts/concepts-value-pairs/specifying-data-types/index.md).




See also the related FilterX function [`set_fields()`](../../../docs/axosyslog-core/4.26/filterx/function-reference/index.md#set-fields), which sets multiple keys of a dict. It differs from `groupset()`: it selects keys explicitly instead of by glob expression, has no equivalent of the `$_` macro, and it can also create new keys.

## Declaration

Terminal window
```
    rewrite <name_of_the_rule> {
        groupset("<new-value-of-the-fields>", values("<field-name-or-glob>" ["<another-field-name-or-glob>"]));
    };
```

## Example: Using groupset rewrite rules

The following examples show how to change the values of multiple fields at the same time.

  * Change the value of the `HOST` field to `myhost`.

Terminal window
```
groupset ("myhost" values("HOST"))
```

  * Change the value of the `HOST` and `FULLHOST` fields to `myhost`.

Terminal window
```
groupset ("myhost" values("HOST" "FULLHOST"))
```

  * Change the value of the `HOST`, `FULLHOST` and fields to lowercase.

Terminal window
```
groupset ("$(lowercase "$_")" values("HOST" "FULLHOST"))
```

  * Change the value of each field and macro that begins with `.USER` to `nobody`.

Terminal window
```
groupset ("nobody" values(".USER.*"))
```

  * Change the value of each field and macro that begins with `.USER` to its SHA-1 hash (truncated to 6 characters).

Terminal window
```
groupset ("$(sha1 --length 6 $_)" values(".USER.*"))
```




## Options

The `groupset()` rewrite rule has the following options.

## condition()

|   
---|---  
Type: | filter expression  
Default: | N/A  
  
_Description:_ Applies the rewrite rule only to the messages that match the specified filter expression. Messages that don’t match the filter pass through the rule unmodified, and continue to the next element of the log path. You can use any filter expression here, and you can reference an existing filter with the `filter()` function. For details, see [Conditional rewrites](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/conditional-rewrite/index.md).

## values()

|   
---|---  
Type: | list of field names or globs  
Default: | N/A  
  
_Description:_ Specifies the fields to modify. You can list the fields explicitly as a space-separated list of double-quoted names, or select multiple fields with glob expressions, for example, `values(".USER.*")`. This option is mandatory. Note that `groupset()` only modifies existing fields, it doesn’t create new ones.

Last modified August 10, 2026: [Sync rewrite rule options with the source (d33662b7)](<https://github.com/axoflow/axosyslog-core-docs/commit/d33662b7e6212a930666d724aa0ba2f88d4ba4ae>)