Graylog Beats "source"

[trajano (Archimedes Trajano)]

Hi, how do I configure graylog / beats to use the beats agent_name or agent_hostname as the source field. I know source is reserved so I can’t change it in the pipeline

I presume it would be in beats configuration itself, but I am not sure what field to set.

[tmacgbay]

Maybe poking around in here will get you what you want? The version is older but there are a couple of pages of beats configuration in there that still hold true.

[megan201296 (Megan)]

@trajano you can change the source in the pipeline, just not delete it. Below is what I used in a pipeline for setting the source for my packetbeat logs:

set_field("source", to_string($message.packetbeat_host_name));