Change source name PIPELINES

Hi , i need help for a little thing

I want change the name of the source because i don’t want the mac address
So with a Pipeline i try this :

rule “set hostname (9c75142015ba)”
has_field(“source”) == “9c75142015ba”
set_field(“source”, “Wildix_Expert_Telecom”);

But it doesn’t work , can you help me please ?

1 Like

has_field() is a boolean - it will only be TRUE or FALSE. Try this:

     has_field("source")  AND
     to_string($message.source) == "9c75142015ba"
1 Like

So when i activate this rules

How much time it take to see the change in " SEARCH " ?

I activate the first rules yesterday ( when you reply , thanks for your help )

And it work today … so .

Have you applied those rules to a pipeline?

Are the messages you want the rules to be run against being processed by that pipeline?

I guess that your incoming messages have a wrong timestamp that is why it looks like the messages are not processed at the second you save the rule.

Yes i have applied the rules to my pipeline , it’s work but it take a lot of time.

Yea i live France , and when it’s 13h59
It’s 12h59 in Graylog…

It’s working thanks all.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.