You can unset macros or fields of the message, including any user-defined macros created using parsers (for details, see parser: Parse and segment structured messages and db-parser: Process message content with a pattern database (patterndb)). Note that the unset operation completely deletes any previous value of the field that you apply it on.
Unset a field
Use the following syntax:
rewrite <name_of_the_rule> {
unset(value("<field-name>"));
};
Example: Unset a message field
The following example unsets the HOST field of the message.
rewrite r_rewrite_unset{
unset(value("HOST"));
};
See also the equivalent FilterX function, unset().
Unset group
To unset a group of fields, you can use the groupunset() rewrite rule.
rewrite <name_of_the_rule> {
groupunset(values("<expression-for-field-names>"));
};
Example: Unset a group of fields
The following rule clears all SDATA fields:
rewrite r_rewrite_unset_SDATA{
groupunset(values(".SDATA.*"));
};
See also the related FilterX function unset(), which takes an explicit list of fields instead of a name pattern, and unset_empties(), which selects fields by value.