---
title: "Set the facility field"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-manipulating-messages/modifying-messages/rewrite-set-facility/"
last_modified: "2026-08-10T09:40:57+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# Set the facility field

It is possible to set the `facility` field with the `set-facility()` rewrite function. When set, the `set-facility()` rewrite function will only rewrite the `${FACILITY}` field in the message to the first parameter value specified in the function.

> **Note:**
> If the parameter value is not a valid parameter value, the function ignores it and sends a debug message, but the application still sends the message.

FilterX has no `set_facility()` counterpart. See the related [`set_pri()`](https://axoflow.com/docs/axosyslog-core/4.28/filterx/function-reference/index.md#set-pri) function, which sets the combined PRI value (`facility * 8 + severity`), so you cannot set the facility without also setting the severity.

## Declaration

```shell
log {
    source { system(); };
    if (program("postfix")) {
      rewrite { set-facility("mail"); };
    };
    destination { file("/var/log/mail.log"); };
    flags(flow-control);
};
```

## Parameters

The `set-facility()` rewrite function has a single, mandatory parameter that can be defined as follows:

```shell
set-facility( "parameter1" );
```

## Accepted values

The `set-facility()` rewrite function accepts the following numeric strings and named values:

| Numerical Code | Facility name | Facility |
| --- | --- | --- |
| 0 | kern | kernel messages |
| 1 | user | user-level messages |
| 2 | mail | mail system |
| 3 | daemon | system daemons |
| 4 | auth | security/authorization messages |
| 5 | syslog | messages generated internally by syslogd |
| 6 | lpr | line printer subsystem |
| 7 | news | network news subsystem |
| 8 | uucp | UUCP subsystem |
| 9 | cron | clock daemon |
| 10 | authpriv | security/authorization messages |
| 11 | ftp | FTP daemon |
| 12 | ntp | NTP subsystem |
| 13 | security | log audit |
| 14 | console | log alert |
| 15 | solaris-cron | clock daemon |
| 16-23 | local0..local7 | locally used facilities (local0-local7) |

## Example usage for the set-facility() rewrite function

The following two `set-facility()` examples are equivalent:

```shell
rewrite {
  set-facility("security");
  set-facility("13");
  };
```

## Options

The `set-facility()` rewrite rule has the following option.

## condition()

|  |  |
| --- | --- |
| Type: | filter expression |
| Default: | N/A |

*Description:* Applies the rewrite rule only to the messages that match the specified filter expression. Messages that don’t match the filter pass through the rule unmodified, and continue to the next element of the log path. You can use any filter expression here, and you can reference an existing filter with the `filter()` function. For details, see [Conditional rewrites](https://axoflow.com/docs/axosyslog-core/4.28/chapter-manipulating-messages/modifying-messages/conditional-rewrite/index.md).

Last modified August 10, 2026: [Sync rewrite rule options with the source (d33662b7)](https://github.com/axoflow/axosyslog-core-docs/commit/d33662b7e6212a930666d724aa0ba2f88d4ba4ae)