title: rsyslog 7 search and replace message content
body: <p>In rsyslog I am trying to search for a certain keyword in my log message and replace with another but seem to be running in to an issue. Looked around and found very few examples of this but couldn't figure out what am I doing wrong.</p>
  
  <p>I have the following in myrsyslog.conf file</p>
  
  <pre><code>template(name="logline" type="string" string="%timegenerated% %HOSTNAME% %syslogtag% %$!msg%\n")
  
  if re_match($msg,'APP_MAJOR_ALERT$')
  then {
      set $!msg = replace($msg, "APP_MAJOR_ALERT", "APP_MINOR_ALERT");
  } else {
      set $!msg = $msg;
  }
  
  action(type="omfile" file="/tmp/logfile" template="logline")
  </code></pre>
  
  <p>Now this is similar to other examples floating around, I am using re_match to search for lines ending with the search keyword (APP_MAJOR_ALERT) and if it matches then I am replacing MAJOR with MINOR. The else part does nothing but prints the message as is, which seems to work fine.</p>
  
  <p>However in case of a match I am seeing the log simply printing "0" as message. Going through rsyslog (version 7.4.10) documentation indicates that the replace function should be returning the modified string but in my case it returns a "0" I guess.</p>
  
  <pre><code>Sep 26 14:41:22 localhost ec2-user: 0
  </code></pre>
  
  <p>The test input provided was </p>
  
  <pre><code>logger "ERROR o.s.c.c.d.h.DiscoveryClientHealthIndicator - Error com.ecwid.consul.v1.OperationException: OperationException(statusCode=500, statusMessage='Internal Server Error', statusContent='rpc error: rpc error: No cluster leader' svc_APP_GROUP,id_APP_NAME,APP_MAJOR_ALERT"
  </code></pre>
  
  <p>Cant figure out where I am wrong. Perhaps a silly mistake but unable to spot it. Few pair of eyes might help here.</p>