Tagging messages

You can label the messages with custom tags. Tags are simple labels, identified by their names, which must be unique. Currently AxoSyslog can tag a message at the following places:

  • At the source when the message is received.
    • AxoSyslog automatically adds the .source.<id_of_the_source_statement> tag to every incoming message.
    • You can add custom tag using the tags() option of the source.
    • AxoSyslog 4.7 and newer automatically adds the following tags if it encounters errors when parsing syslog messages.

      • message.utf8_sanitized
      • message.parse_error
      • syslog.missing_pri
      • syslog.missing_timestamp
      • syslog.invalid_hostname
      • syslog.unexpected_framing
      • syslog.rfc3164_missing_header
      • syslog.rfc5424_unquoted_sdata_value
  • When the message matches a pattern in the pattern database. For details on using the pattern database, see Using pattern databases, for details on creating tags in the pattern database, see The pattern database format.
  • Tags can be also added and deleted using rewrite rules. For details, see Adding and deleting tags.

You can use the tags() filter to select only specific messages.

  • Tagging messages and also filtering on the tags is very fast, much faster than other types of filters.
  • Tags are available locally, that is, if you add tags to a message on the client, these tags will not be available on the server.
  • To include the tags in the message, use the ${TAGS} macro in a template. Alternatively, if you are using the IETF-syslog message format, you can include the ${TAGS} macro in the .SDATA.meta part of the message. Note that the ${TAGS} macro is available only in AxoSyslog 3.1.1 and later.

For an example on tagging, see Example: Adding tags and filtering messages with tags.

Last modified April 19, 2024: [4.7] Documents parser error tags (446cd3e)