Tagging messages

You can label the messages with custom tags. Tags are simple labels, identified by their names, which must be unique. Currently AxoSyslog can tag a message at the following places:

• At the source when the message is received.
  • AxoSyslog automatically adds the .source.<id_of_the_source_statement> tag to every incoming message.
  • You can add custom tag using the tags() option of the source.

  • AxoSyslog 4.7 and newer automatically adds the following tags if it encounters errors when parsing syslog messages.

    • message.utf8_sanitized
    • message.parse_error
    • syslog.missing_pri
    • syslog.missing_timestamp
    • syslog.invalid_hostname
    • syslog.unexpected_framing
    • syslog.rfc3164_missing_header
    • syslog.rfc5424_unquoted_sdata_value
• When the message matches a pattern in the pattern database. For details on using the pattern database, see Using pattern databases, for details on creating tags in the pattern database, see The pattern database format.
• Tags can be also added and deleted using rewrite rules. For details, see Adding and deleting tags.

You can use the tags() filter to select only specific messages.

• Tagging messages and also filtering on the tags is very fast, much faster than other types of filters.
• Tags are available locally, that is, if you add tags to a message on the client, these tags will not be available on the server.
• To include the tags in the message, use the ${TAGS} macro in a template. Alternatively, if you are using the IETF-syslog message format, you can include the ${TAGS} macro in the .SDATA.meta part of the message. Note that the ${TAGS} macro is available only in AxoSyslog 3.1.1 and later.

For an example on tagging, see Example: Adding tags and filtering messages with tags.