Graylog Beats "source"

Hi, how do I configure graylog / beats to use the beats agent_name or agent_hostname as the source field. I know source is reserved so I can’t change it in the pipeline

I presume it would be in beats configuration itself, but I am not sure what field to set.

Maybe poking around in here will get you what you want? The version is older but there are a couple of pages of beats configuration in there that still hold true.

@trajano you can change the source in the pipeline, just not delete it. Below is what I used in a pipeline for setting the source for my packetbeat logs:

set_field("source", to_string($message.packetbeat_host_name));
1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.