Unset message fields

You can unset macros or fields of the message, including any user-defined macros created using parsers (for details, see parser: Parse and segment structured messages and db-parser: Process message content with a pattern database (patterndb)). Note that the unset operation completely deletes any previous value of the field that you apply it on.

Unset a field

Use the following syntax:

rewrite <name_of_the_rule> {
    unset(value("<field-name>"));
};

Example: Unset a message field

The following example unsets the HOST field of the message.

rewrite r_rewrite_unset{
    unset(value("HOST"));
};

Unset group

To unset a group of fields, you can use the groupunset() rewrite rule.

rewrite <name_of_the_rule> {
    groupunset(values("<expression-for-field-names>"));
};

Example: Unset a group of fields

The following rule clears all SDATA fields:

rewrite r_rewrite_unset_SDATA{
    groupunset(values(".SDATA.*"));
};