# Set message fields to specific values To set a field of the message to a specific value, you have to: * define the string to include in the message, and * select the field where it should be included. * You can set the type of the field. Where you can use of templates in `set()` and `groupset()`, you can use type-casting, and the type information is properly promoted. For details, see [Specifying data types in value-pairs](../../../docs/axosyslog-core/4.26/chapter-concepts/concepts-value-pairs/specifying-data-types/index.md). You can set the value of available macros, for example, HOST, MESSAGE, PROGRAM, or any user-defined macros created using parsers (for details, see [parser: Parse and segment structured messages](../../../docs/axosyslog-core/4.26/chapter-parsers/index.md) and [db-parser: Process message content with a pattern database (patterndb)](../../../docs/axosyslog-core/4.26/chapter-parsers/chapter-patterndb/index.md)). Note that the rewrite operation completely replaces any previous value of that field. Note Hard macros cannot be modified. For details, see [Hard versus soft macros](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/customizing-message-format/macros-hard-vs-soft/index.md). See also the equivalent FilterX operation, [assigning a value](../../../docs/axosyslog-core/4.26/filterx/index.md#assign-values). Use the following syntax: ## Declaration Terminal window ``` rewrite { set("", value()); }; ``` ## Example: Set message fields to a particular value The following example sets the HOST field of the message to `myhost`. Terminal window ``` rewrite r_rewrite_set{ set("myhost", value("HOST")); }; ``` The following example appends the “suffix” string to the MESSAGE field: Terminal window ``` rewrite r_rewrite_set{ set("$MESSAGE suffix", value("MESSAGE")); }; ``` For details on rewriting SDATA fields, see [Create custom SDATA fields](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/custom-sdata-fields/index.md). Note The `severity` and `facility` fields can only be set by the `set-severity()` rewrite functions. For more information, see [Set the severity field](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/rewrite-set-severity/index.md). ## Options The `set()` rewrite rule has the following options. In addition to `condition()`, `internal()`, and `value()`, `set()` accepts the template options listed below, which control how AxoSyslog expands the template in its first argument. Terminal window ``` rewrite { set("", value(), on-error("fallback-to-string")); }; ``` ## condition() | ---|--- Type: | filter expression Default: | N/A _Description:_ Applies the rewrite rule only to the messages that match the specified filter expression. Messages that don’t match the filter pass through the rule unmodified, and continue to the next element of the log path. You can use any filter expression here, and you can reference an existing filter with the `filter()` function. For details, see [Conditional rewrites](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/conditional-rewrite/index.md). ## frac-digits() | ---|--- Type: | number Default: | `0` _Description:_ The number of digits that AxoSyslog stores when it expands a timestamp macro with fractions of a second. Overrides the global [`frac-digits()`](../../../docs/axosyslog-core/4.26/chapter-global-options/reference-options/index.md#global-option-frac-digits) option for this rule. ## internal() | ---|--- Accepted values: | `yes`, `no` Default: | `no` _Description:_ Marks this pipeline element as internal. Elements marked as `internal()` are treated as an implementation detail, so for example statistics of the given pipe are available only on higher stats level. This option is mainly useful for developers or when writing SCL blocks and integrations. ## local-time-zone() | ---|--- Type: | name of the timezone, or the timezone offset Default: | The local timezone. _Description:_ Sets the timezone that AxoSyslog uses when it expands a timestamp macro as a local time. The timezone can be specified by using the name, for example, `time-zone("Europe/Budapest")`), or as the timezone offset in +/-HH:MM format, for example, `+01:00`). On Linux and UNIX platforms, the valid timezone names are listed under the `/usr/share/zoneinfo` directory. ## on-error() Type: | One of: `drop-message`, `drop-property`, `fallback-to-string`, `silently-drop-message`, `silently-drop-property`, `silently-fallback-to-string` ---|--- Default: | Use the global setting (which defaults to `drop-message`) _Description:_ Controls what happens when type-casting fails and AxoSyslog cannot convert some data to the specified type. By default, AxoSyslog drops the entire message and logs the error. Currently the `value-pairs()` option uses the settings of `on-error()`. * `drop-message`: Drop the entire message and log an error message to the `internal()` source. This is the default behavior of AxoSyslog. * `drop-property`: Omit the affected property (macro, template, or message-field) from the log message and log an error message to the `internal()` source. * `fallback-to-string`: Convert the property to string and log an error message to the `internal()` source. * `silently-drop-message`: Drop the entire message silently, without logging the error. * `silently-drop-property`: Omit the affected property (macro, template, or message-field) silently, without logging the error. * `silently-fallback-to-string`: Convert the property to string silently, without logging the error. ## send-time-zone() | ---|--- Type: | name of the timezone, or the timezone offset Default: | The local timezone. _Description:_ Sets the timezone that AxoSyslog uses when it expands a timestamp macro. The `time-zone()` option is an alias of `send-time-zone()`. The timezone can be specified by using the name, for example, `time-zone("Europe/Budapest")`), or as the timezone offset in +/-HH:MM format, for example, `+01:00`). On Linux and UNIX platforms, the valid timezone names are listed under the `/usr/share/zoneinfo` directory. ## template-escape() | ---|--- Type: | `yes`, `no` Default: | `no` _Description:_ Turns on escaping for the `'`, `"`, and backspace characters in the expanded value. ## time-zone() | ---|--- Type: | name of the timezone, or the timezone offset Default: | The local timezone. _Description:_ Alias of [`send-time-zone()`](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/rewrite-set/index.md#send-time-zone). ## ts-format() | ---|--- Type: | `rfc3164`, `bsd`, `rfc3339`, `iso` Default: | `rfc3164` _Description:_ Overrides the global [`ts-format()`](../../../docs/axosyslog-core/4.26/chapter-global-options/reference-options/index.md) option for the timestamp macros that this rule expands. ## value() | ---|--- Type: | name of a message field Default: | `MESSAGE` _Description:_ Selects the field of the message that the rewrite rule modifies. If you don’t set it, the rule operates on the `MESSAGE` field. Write the name of the field without the `$` prefix, for example, `value("HOST")`, not `value("$HOST")`. The `$` prefix is only needed in templates, and AxoSyslog logs a warning if you use it here. You cannot set a hard macro in the `value()` option, AxoSyslog rejects the configuration with an error. Last modified August 10, 2026: [Sync rewrite rule options with the source (d33662b7)]()