# Unset message fields

You can unset macros or fields of the message, including any user-defined macros created using parsers (for details, see [parser: Parse and segment structured messages](../../../docs/axosyslog-core/4.26/chapter-parsers/index.md) and [db-parser: Process message content with a pattern database (patterndb)](../../../docs/axosyslog-core/4.26/chapter-parsers/chapter-patterndb/index.md)). Note that the unset operation completely deletes any previous value of the field that you apply it on.

Note Hard macros cannot be modified. For details, see [Hard versus soft macros](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/customizing-message-format/macros-hard-vs-soft/index.md). 

## Unset a field

Use the following syntax:

Terminal window
```
    rewrite <name_of_the_rule> {
        unset(value("<field-name>"));
    };
```

## Example: Unset a message field

The following example unsets the HOST field of the message.

Terminal window
```
    rewrite r_rewrite_unset{
        unset(value("HOST"));
    };
```

If you’re using FilterX, see also the equivalent [`unset()`](../../../docs/axosyslog-core/4.26/filterx/function-reference/index.md#unset) function.

## Unset group

To unset a group of fields, you can use the `groupunset()` rewrite rule.

Terminal window
```
    rewrite <name_of_the_rule> {
        groupunset(values("<expression-for-field-names>"));
    };
```

## Example: Unset a group of fields

The following rule clears all SDATA fields:

Terminal window
```
    rewrite r_rewrite_unset_SDATA{
        groupunset(values(".SDATA.*"));
    };
```

## Options

The `unset()` rewrite rule has the following options.

## condition()

|   
---|---  
Type: | filter expression  
Default: | N/A  
  
_Description:_ Applies the rewrite rule only to the messages that match the specified filter expression. Messages that don’t match the filter pass through the rule unmodified, and continue to the next element of the log path. You can use any filter expression here, and you can reference an existing filter with the `filter()` function. For details, see [Conditional rewrites](../../../docs/axosyslog-core/4.26/chapter-manipulating-messages/modifying-messages/conditional-rewrite/index.md).

## internal()

|   
---|---  
Accepted values: | `yes`, `no`  
Default: | `no`  
  
_Description:_ Marks this pipeline element as internal. Elements marked as `internal()` are treated as an implementation detail, so for example statistics of the given pipe are available only on higher stats level. This option is mainly useful for developers or when writing SCL blocks and integrations.

## value()

|   
---|---  
Type: | name of a message field  
Default: | `MESSAGE`  
  
_Description:_ Selects the field of the message that the rewrite rule modifies. If you don’t set it, the rule operates on the `MESSAGE` field.

Write the name of the field without the `$` prefix, for example, `value("HOST")`, not `value("$HOST")`. The `$` prefix is only needed in templates, and AxoSyslog logs a warning if you use it here. You cannot set a hard macro in the `value()` option, AxoSyslog rejects the configuration with an error.

The `groupunset()` rewrite rule has the `condition()` option described above, and the following option.

## values()

|   
---|---  
Type: | list of field names or globs  
Default: | N/A  
  
_Description:_ Specifies the fields to unset. You can list the fields explicitly as a space-separated list of double-quoted names, or select multiple fields with glob expressions, for example, `values(".SDATA.*")`. This option is mandatory.

Last modified August 10, 2026: [Sync rewrite rule options with the source (d33662b7)](<https://github.com/axoflow/axosyslog-core-docs/commit/d33662b7e6212a930666d724aa0ba2f88d4ba4ae>)