11.2.6. Conditional rewrites The syslog-ng Premium Edition 7 Administrator Guide
Starting with 4 F1, it is possible to apply a rewrite rule to a message only if certain conditions are met. The
condition() option effectively embeds a filter expression into the rewrite rule: the message is modified only if the message passes the filter. If the condition is not met, the message is passed to the next element of the log path (that is, the element following the rewrite rule in the log statement, for example, the destination). Any filter expression normally used in filters can be used as a rewrite condition. Existing filter statements can be referenced using the
filter() function within the condition. For details on filters, see Section 8.4, Filters.
Using conditions in rewrite rules can simplify your syslog-ng PE configuration file, as you do not need to create separate log paths to modify certain messages.