Is there a way to rewrite parts of a message globally instead of inserting rewrite on all log paths?

Question

I need to escape \n from the message. I can do this with "rewrite" but the problem is I have many log paths and I do not want to specify "rewrite" on all log paths. Is there a global way of setting a rewrite?

# Escape the new line characters
rewrite r_escape_new_line {subst("\n", "#012", value("MSG"), flags("global"));};
log { source(s_system); filter(f_critical); rewrite(r_escape_new_line); destination(d_critical); };
log { source(s_system); filter(f_error); rewrite(r_escape_new_line); destination(d_error); };
log { source(s_system); filter(f_warning); rewrite(r_escape_new_line); destination(d_warning); };

Answer 1

Try to add the flags(no-multi-line) option to your source definition, like:

source s_src {
   system(flags(no-multi-line));
   internal();

};

If this does not work, then you can embed the rewrite into the source definition using a channel. The syslog-ng administrator guide has a similar example, you only have to replace the parser with the rewrite.

HTH.