<match kolla.var.log.kolla.*.*.log>
    @type rewrite_tag_filter
    capitalize_regex_backreference yes
    rewriterule1 programname ^(cinder-api-access|cloudkitty-api-access|gnocchi-api-access|horizon-access|keystone-apache-admin-access|keystone-apache-public-access|monasca-api-access|monasca-log-api-access|placement-api-access|panko-api-access)$ apache_access
    rewriterule2 programname ^(aodh_wsgi_access|barbican-api|zun_api_wsgi_access|vitrage_wsgi_access)$ wsgi_access
    rewriterule3 programname ^(nova-api|nova-compute|nova-compute-ironic|nova-conductor|nova-consoleauth|nova-manage|nova-novncproxy|nova-scheduler|nova-placement-api|placement-api|privsep-helper)$ openstack_python
    rewriterule4 programname ^(sahara-api|sahara-engine)$ openstack_python
    rewriterule5 programname ^(neutron-server|neutron-openvswitch-agent|neutron-ns-metadata-proxy|neutron-metadata-agent|neutron-l3-agent|neutron-dhcp-agent)$ openstack_python
    rewriterule6 programname ^(magnum-conductor|magnum-api)$ openstack_python
    rewriterule7 programname ^(keystone)$ openstack_python
    rewriterule8 programname ^(heat-engine|heat-api|heat-api-cfn)$ openstack_python
    rewriterule9 programname ^(glance-api|glance-registry)$ openstack_python
    rewriterule10 programname ^(cloudkitty-storage-init|cloudkitty-processor|cloudkitty-dbsync|cloudkitty-api)$ openstack_python
    rewriterule11 programname ^(ceilometer-polling|ceilometer-agent-notification)$ openstack_python
    rewriterule12 programname ^(barbican-worker|barbican-keystone-listener|barbican-db-manage|app)$ openstack_python
    rewriterule13 programname ^(aodh-notifier|aodh-listener|aodh-evaluator|aodh-dbsync)$ openstack_python
    rewriterule14 programname ^(cinder-api|cinder-scheduler|cinder-manage|cinder-volume|cinder-backup|privsep-helper)$ openstack_python
    rewriterule15 programname ^(mistral-server)$ openstack_python
    rewriterule16 programname ^(designate-api|designate-central|designate-manage|designate-mdns|designate-sink|designate-worker)$ openstack_python
    rewriterule17 programname ^(manila-api|manila-data|manila-manage|manila-share|manila-scheduler)$ openstack_python
    rewriterule18 programname ^(trove-api|trove-conductor|trove-manage|trove-taskmanager)$ openstack_python
    rewriterule19 programname ^(congress-server)$ openstack_python
    rewriterule20 programname ^(murano-api|murano-engine)$ openstack_python
    rewriterule21 programname ^(senlin-api|senlin-engine)$ openstack_python
    rewriterule22 programname ^(watcher-api|watcher-applier|watcher-db-manage|watcher-decision-engine)$ openstack_python
    rewriterule23 programname ^(freezer-api|freezer-api_access|freezer-manage)$ openstack_python
    rewriterule24 programname ^(octavia-api|octavia-health-manager|octavia-housekeeping|octavia-worker)$ openstack_python
    rewriterule25 programname ^(zun-api|zun-compute)$ openstack_python
    rewriterule26 programname ^(kuryr-server)$ openstack_python
    rewriterule27 programname ^(gnocchi-api|gnocchi-statsd|gnocchi-metricd|gnocchi-upgrade)$ openstack_python
    rewriterule28 programname ^(ironic-api|ironic-conductor|ironic-inspector)$ openstack_python
    rewriterule29 programname ^(panko-api|panko-dbsync)$ openstack_python
    rewriterule30 programname ^(tacker-server|tacker-conductor)$ openstack_python
    rewriterule31 programname ^(vitrage-collector|vitrage-ml|vitrage-notifier|vitrage-graph)$ openstack_python
    rewriterule32 programname ^(blazar-api|blazar-manager)$ openstack_python
</match>
