Multiple log rewrite directives for the same field show unexpected behaviour



For whichever reason, you want to rewrite the same log field multiple times in multiple proxy layers. You observe however that, contrary to how policy evaluation takes place, only the first rewrite is performed - subsequent rewrites are ignored.


This is by design. Only the first (matching) rewrite will be performed. If you must perform multiple (identical in terms of the action) rewrites you should do them all on a single layer, starting with the most restrictive condition and ending in the least restrictive condition.

This is best practice not only for performance reasons but also to prevent log.rewrite rules from interfering with policy decisions.

Additional Information
Bug Number
InQuira Doc IdKB5129

Article Feedback

Did this Article solve your issue?
Additional Comments:
Previous MonthNext Month