csback_syslog-ng.conf: restrict lines to those with keywords in the header

csback_syslog-ng.conf

@@ -4,6 +4,7 @@
 #
 # Copy the content of this file to /etc/syslog-ng/syslog-ng.conf or simply add
 # include "path/to/this/file";
+#
 # Alternatively copy this file to /etc/syslog-ng/conf.d
 #
 # This version was tested with syslog-ng 3.7.1
@@ -12,6 +13,9 @@
 # configration.
 #
 # See README.syslog for general comments.
+#
+# -----------------------------------------------------------------------------
+# $Id$
 # -----------------------------------------------------------------------------
 #
 # REVISION:
@@ -23,6 +27,8 @@
 #                       the changes make csback messages be properly logged
 #   2016/07/25   V1.4   adjust to operate correctly with recent version of
 #                       syslog
+#   2018/08/02   V1.4   (thof): restrict filters to entries with csback
+#                               strings in the message header
 #
 # =============================================================================
 # use network port for phython logging mechanism
@@ -32,7 +38,8 @@ udp(ip(0.0.0.0) port(3333));
 };
 
 # csback related
-filter fil_csback { match('.*csback.*'); };
+filter fil_csback { match('.*csback.*' value(MSGHDR)); };
+
 destination csbacklog {
   file("/var/log/csback.log"
     perm(0644) fsync(yes)
@@ -50,19 +57,20 @@ destination csbackStatus {
     template("${DATE} ${FULLHOST} ${MSGHDR}${MSG}\n")
     template-escape(no));
 };
-filter fil_csbackCritical { match('.*csback.*CRITICAL.*'); };
+filter fil_csbackCritical { match('.*csback.*CRITICAL.*' value(MSGHDR)); };
 log { source(csback); source(src); 
       filter(fil_csbackCritical); 
       destination(csbackStatus); };
 
 # BFO2LSDF related
-filter fil_BFO2LSDF { match('.*BFO2LSDF.*'); };
+#source BFOLSDFsrc { unix-stream("/dev/log"); internal(); };
+filter fil_BFO2LSDF { match('.*BFO2LSDF.*' value(MSGHDR)); };
 log { source(csback); source(src); 
       filter(fil_BFO2LSDF); 
       destination(csbacklog); };
 
 # csclean related
-filter fil_csclean { match('.*csclean.*'); };
+filter fil_csclean { match('.*csclean.*' value(MSGHDR)); };
 log { source(csback); source(src); 
       filter(fil_csclean); 
       destination(csbacklog); };