I need to escape \n from the message. I can do this with "rewrite" but the problem is I have many log paths and I do not want to specify "rewrite" on all log paths. Is there a global way of setting a rewrite?

# Escape the new line characters
rewrite r_escape_new_line {subst("\n", "#012", value("MSG"), flags("global"));};
log { source(s_system); filter(f_critical); rewrite(r_escape_new_line); destination(d_critical); };
log { source(s_system); filter(f_error); rewrite(r_escape_new_line); destination(d_error); };
log { source(s_system); filter(f_warning); rewrite(r_escape_new_line); destination(d_warning); };

Try to add the flags(no-multi-line) option to your source definition, like:

source s_src {


If this does not work, then you can embed the rewrite into the source definition using a channel. The syslog-ng administrator guide has a similar example, you only have to replace the parser with the rewrite.


  • flags(no-multi-line) worked like a charm! Thanks. – Umut Oct 20 '16 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.