Change source name PIPELINES

[gcolmant (Colmant)]

Hi , i need help for a little thing

I want change the name of the source because i don’t want the mac address
So with a Pipeline i try this :

rule “set hostname (9c75142015ba)”
when
has_field(“source”) == “9c75142015ba”
then
set_field(“source”, “Wildix_Expert_Telecom”);
end

But it doesn’t work , can you help me please ?

[tmacgbay]

has_field() is a boolean - it will only be TRUE or FALSE. Try this:

when
     has_field("source")  AND
     to_string($message.source) == "9c75142015ba"
then

[gcolmant (Colmant)]

So when i activate this rules

How much time it take to see the change in " SEARCH " ?

I activate the first rules yesterday ( when you reply , thanks for your help )

And it work today … so .

[Ponet (Jesse Hills)]

Have you applied those rules to a pipeline?

Are the messages you want the rules to be run against being processed by that pipeline?

[jan (Jan Doberstein)]

I guess that your incoming messages have a wrong timestamp that is why it looks like the messages are not processed at the second you save the rule.

[gcolmant (Colmant)]

Yes i have applied the rules to my pipeline , it’s work but it take a lot of time.

Yea i live France , and when it’s 13h59
It’s 12h59 in Graylog…

It’s working thanks all.