diff --git a/ansible/roles/common/templates/conf/filter/01-rewrite.conf.j2 b/ansible/roles/common/templates/conf/filter/01-rewrite.conf.j2
index 3f66fed316..30467357a4 100644
--- a/ansible/roles/common/templates/conf/filter/01-rewrite.conf.j2
+++ b/ansible/roles/common/templates/conf/filter/01-rewrite.conf.j2
@@ -1,28 +1,154 @@
 <match kolla.var.log.kolla.*.*.log>
     @type rewrite_tag_filter
     capitalize_regex_backreference yes
-    rewriterule1 programname ^(horizon-access|ceilometer-api-access|keystone-apache-admin-access|keystone-apache-public-access|cinder-api-access)$ apache_access
-    rewriterule2 programname ^aodh_wsgi_access$ wsgi_access
-    rewriterule3 programname ^(nova-api|nova-compute|nova-conductor|nova-consoleauth|nova-manage|nova-novncproxy|nova-scheduler|nova-placement-api|placement-api|placement-api-access|privsep-helper).* openstack_python
-    rewriterule4 programname ^(sahara-api|sahara-engine).* openstack_python
-    rewriterule5 programname ^(neutron-server|neutron-openvswitch-agent|neutron-ns-metadata-proxy|neutron-metadata-agent|neutron-l3-agent|neutron-dhcp-agent).* openstack_python
-    rewriterule6 programname ^(magnum-conductor|magnum-api).* openstack_python
-    rewriterule7 programname ^(keystone).* openstack_python
-    rewriterule8 programname ^(heat-engine|heat-api|heat-api-cfn).* openstack_python
-    rewriterule9 programname ^(glance-api|glance-registry).* openstack_python
-    rewriterule10 programname ^(cloudkitty-storage-init|cloudkitty-processor|cloudkitty-dbsync|cloudkitty-api).* openstack_python
-    rewriterule11 programname ^(ceilometer-polling|ceilometer-collector|ceilometer-agent-notification|loadwsgi).* openstack_python
-    rewriterule12 programname ^(barbican-worker|barbican-keystone-listener|barbican-db-manage|barbican-api|app).* openstack_python
-    rewriterule13 programname ^(aodh-notifier|aodh-listener|aodh-evaluator|aodh-dbsync).* openstack_python
-    rewriterule14 programname ^(cinder-api|cinder-scheduler|cinder-manage|cinder-volume|cinder-backup|privsep-helper).* openstack_python
-    rewriterule15 programname ^(mistral-server).* openstack_python
-    rewriterule16 programname ^(designate-api|designate-central|designate-manage|designate-mdns|designate-sink|designate-worker).* openstack_python
-    rewriterule17 programname ^(manila-api|manila-data|manila-manage|manila-share|manila-scheduler).* openstack_python
-    rewriterule18 programname ^(trove-api|trove-conductor|trove-manage|trove-taskmanager).* openstack_python
-    rewriterule19 programname ^(congress-server).* openstack_python
-    rewriterule20 programname ^(murano-api|murano-engine).* openstack_python
-    rewriterule21 programname ^(senlin-api|senlin-engine).* openstack_python
-    rewriterule22 programname ^(watcher-api|watcher-applier|watcher-db-manage|watcher-decision-engine).* openstack_python
-    rewriterule23 programname ^(freezer-api|freezer-api_access|freezer-manage).* openstack_python
-    rewriterule24 programname ^(octavia-api|octavia-health-manager|octavia-housekeeping|octavia-worker).* openstack_python
+  <rule>
+    key     programname
+    pattern ^(cinder-api-access|cloudkitty-api-access|gnocchi-api-access|horizon-access|keystone-apache-admin-access|keystone-apache-public-access|placement-api-access|panko-api-access)$
+    tag apache_access
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(aodh_wsgi_access|barbican-api|zun_api_wsgi_access)$
+    tag wsgi_access
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(nova-api|nova-compute|nova-compute-ironic|nova-conductor|nova-consoleauth|nova-manage|nova-novncproxy|nova-scheduler|nova-placement-api|placement-api|privsep-helper)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(sahara-api|sahara-engine)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(neutron-server|neutron-openvswitch-agent|neutron-ns-metadata-proxy|neutron-metadata-agent|neutron-l3-agent|neutron-dhcp-agent)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(magnum-conductor|magnum-api)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(keystone)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(heat-engine|heat-api|heat-api-cfn)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(glance-api|glance-registry)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(cloudkitty-storage-init|cloudkitty-processor|cloudkitty-dbsync|cloudkitty-api)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(ceilometer-polling|ceilometer-agent-notification)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(barbican-worker|barbican-keystone-listener|barbican-db-manage|app)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(aodh-notifier|aodh-listener|aodh-evaluator|aodh-dbsync)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(cinder-api|cinder-scheduler|cinder-manage|cinder-volume|cinder-backup|privsep-helper)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(mistral-server)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(designate-api|designate-central|designate-manage|designate-mdns|designate-sink|designate-worker)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(manila-api|manila-data|manila-manage|manila-share|manila-scheduler)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(trove-api|trove-conductor|trove-manage|trove-taskmanager)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(congress-server)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(murano-api|murano-engine)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(senlin-api|senlin-engine)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(watcher-api|watcher-applier|watcher-db-manage|watcher-decision-engine)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(freezer-api|freezer-api_access|freezer-manage)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(octavia-api|octavia-health-manager|octavia-housekeeping|octavia-worker)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(zun-api|zun-compute)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(kuryr-server)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(gnocchi-api|gnocchi-statsd|gnocchi-metricd|gnocchi-upgrade)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(ironic-api|ironic-conductor)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(panko-api|panko-dbsync)$
+    tag openstack_python
+  </rule>
+  <rule>
+    key     programname
+    pattern ^(tacker-server|tacker-conductor)$
+    tag openstack_python
+  </rule>
 </match>