Multiple log rewrite directives for the same field show unexpected behaviour
For whichever reason, you want to rewrite the same log field multiple times in multiple proxy layers. You observe however that, contrary to how policy evaluation takes place, only the first rewrite is performed - subsequent rewrites are ignored.
This is by design. Only the first (matching) rewrite will be performed. If you must perform multiple (identical in terms of the action) rewrites you should do them all on a single layer, starting with the most restrictive condition and ending in the least restrictive condition.
This is best practice not only for performance reasons but also to prevent log.rewrite rules from interfering with policy decisions.
Rate this Page
Please take a moment to complete this form to help us better serve you.