syslog include filter that adds a text string to events

[cdjac0bsen]

I would like to add a text string like "ASM_system_error" to every local3 event of level critical to emergency since syslog doesn't include the severity level in the log event itself (unless we have something configured wrong). Right now the include statement is something like this:

sys syslog include "filter f_waffilter { facility(local3) and (level(emerg) or level(alert) or level(crit));};destination waf_udp { udp(9.9.9.9 port(9999));}; log { source(local); filter(f_waffilter); destination(waf_udp);};"

[Kevin_Davies]

Templates of syslog-ng do this but there is no guarantee that its works on an F5. YMMV

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.17/administration-...

[cdjac0bsen]

Thanks, Kevin. That seems like a lot of work. Was hoping for a simple addition to the include filter. Oh well. Does anyone know why the severity level isn't included in the log event sent remotely?