Multiple log rewrite directives for the same field show unexpected behaviour

Solutions ID:    KB5129
Version:    1.0
Status:    Published
Published date:    05/23/2012

Problem Description

For whichever reason, you want to rewrite the same log field multiple times in multiple proxy layers. You observe however that, contrary to how policy evaluation takes place, only the first rewrite is performed - subsequent rewrites are ignored.


This is by design. Only the first (matching) rewrite will be performed. If you must perform multiple (identical in terms of the action) rewrites you should do them all on a single layer, starting with the most restrictive condition and ending in the least restrictive condition.

This is best practice not only for performance reasons but also to prevent log.rewrite rules from interfering with policy decisions.

Rate this Page

Please take a moment to complete this form to help us better serve you.

Did this document help answer your question?
If you are finished providing feedback, please click the RATE CONTENT button. Otherwise, please add more detail in the following text box and then click RATE CONTENT.

Your response will be used to improve our document content.

Ask a Question