Multiple log rewrite directives for the same field show unexpected behaviour

Solution

Overview

For whichever reason, you want to rewrite the same log field multiple times in multiple proxy layers. You observe however that, contrary to how policy evaluation takes place, only the first rewrite is performed - subsequent rewrites are ignored.

Cause
Resolution

This is by design. Only the first (matching) rewrite will be performed. If you must perform multiple (identical in terms of the action) rewrites you should do them all on a single layer, starting with the most restrictive condition and ending in the least restrictive condition.

This is best practice not only for performance reasons but also to prevent log.rewrite rules from interfering with policy decisions.

Workaround
Additional Information
Bug Number
InQuira Doc IdKB5129
Attachment

Article Feedback

Did this Article solve your issue?
Additional Comments:
 
Previous MonthNext Month
SunMonTueWedThuFriSat