8.4.5. Tagging messages
You can label the messages with custom tags. Tags are simple labels, identified by their names, which must be unique. Currently syslog-ng OSE can tag a message at two different places:
at the source when the message is received, and
when the message matches a pattern in the pattern database. For details on using the pattern database, see Section 13.2, Using pattern databases, for details on creating tags in the pattern database, see Section 13.5.3, The syslog-ng pattern database format.
Tags can be also added and deleted using rewrite rules. For details, see Section 11.2.8, Adding and deleting tags.
When syslog-ng receives a message, it automatically adds the
.source.<id_of_the_source_statement> tag to the message. Use the
tags() option of the source to add custom tags, and the
tags() option of the filters to select only specific messages.
For an example on tagging, see Example 8.15, Adding tags and filtering messages with tags.