# Modify messages using rewrite rules

The AxoSyslog application can rewrite parts of the messages using rewrite rules. Rewrite rules are global objects similar to parsers and filters and can be used in log paths. The AxoSyslog application has two methods to rewrite parts of the log messages: substituting (setting) a part of the message to a fix value, and a general search-and-replace mode.

  * Substitution completely replaces a specific part of the message that is referenced using a built-in or user-defined macro.
  * General rewriting searches for a string in the entire message (or only a part of the message specified by a macro) and replaces it with another string. Optionally, this replacement string can be a template that contains macros.



Rewriting messages is often used in conjunction with message parsing [parser: Parse and segment structured messages](../../docs/axosyslog-core/chapter-parsers/index.md).

Rewrite rules are similar to filters: they must be defined in the `syslog-ng.conf` configuration file and used in the log statement. You can also define the rewrite rule inline in the log path.

Note The order of filters, rewriting rules, and parsers in the log statement is important, as they are processed sequentially. 

* * *

[Replace message parts](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-replace/index.md)

[Set message fields to specific values](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set/index.md)

[Set the severity field](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set-severity/index.md)

[Set the facility field](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set-facility/index.md)

[Set the priority of a message](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set-pri/index.md)

[Set match variables](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-set-matches/index.md)

[Unset message fields](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-unset/index.md)

[Rename message fields](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-rename/index.md)

[Create custom SDATA fields](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/custom-sdata-fields/index.md)

[Set multiple message fields to specific values](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-groupset/index.md)

[map-value-pairs: Rename value-pairs to normalize logs](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/parser-map-value-pairs/index.md)

[Conditional rewrites](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/conditional-rewrite/index.md)

[Add and delete tags](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-tags/index.md)

[Rewrite the timezone of a message](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/rewrite-timezone/index.md)

[Anonymize credit card numbers](../../docs/axosyslog-core/chapter-manipulating-messages/modifying-messages/anonymizing-credit-card-numbers/index.md)

Last modified April 9, 2025: [Rewrite-related formatting fixes and title shortenings (07c928a3)](<https://github.com/axoflow/axosyslog-core-docs/commit/07c928a36247e7d98c8d00726187c3afdbc96875>)