rewrite in syslog-ng

Running OSE version 3.38.1 and having difficulty with a rewrite rule.

The logs that I'm trying to modify look like:

2024-09-12T06:39:31-05:00 hostname kernel: [*09/12/2024 11:39:31.9055] bwar: [7649:I:CN_ML] ...

What I am trying to do is remove the extra timestamp in square brackets (the first field in square brackets above.)

My rewrite rule looks like:

rewrite r_bracketed_ts {
    subst( '^[.+]\s', '', type(pcre), value("MESSAGE"));
};

It is invoked from this log statement:

log {
    source(s_BSD_UDP_514);
    filter(f_something);
    rewrite(r_bracketed_ts);
    destination(d_something);
    flags(final,flow-control);
};


The problem is that the rewrite appears to do nothing; log entries come out unmodified. Am I missing something?

Thank you -
Jon Wilson

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq