# Parsing syslog messages
**URL:** https://community.graylog.org/t/parsing-syslog-messages/2667
**Category:** Graylog Central (peer support)
**Created:** [October 3, 2017, 1:58pm UTC](https://community.graylog.org/t/parsing-syslog-messages/2667 "2017-10-03T13:58:06Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Mr\_Reyes](https://community.graylog.org/u/Mr_Reyes)
#### Post date: [October 3, 2017, 1:58pm UTC](https://community.graylog.org/t/parsing-syslog-messages/2667/1 "2017-10-03T13:58:06Z")
Hey there
is there a way to set the source in the syslog message to be the ip form which it arrived, and not the one the device enters as source?
i have a lot of devices, that sets their username as source, instead of their ip or hostname, which makes it very difficult to extrapolate the logs…
b4 i used netxms as syslog parser, and i could change it so…
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [October 3, 2017, 4:36pm UTC](https://community.graylog.org/t/parsing-syslog-messages/2667/2 "2017-10-03T16:36:53Z")
> [@Mr\_Reyes](#):
>
> is there a way to set the source in the syslog message to be the ip form which it arrived, and not the one the device enters as source?
Yes, you could copy the content of the “gl2\_remote\_ip” field (which contains the IP address of the client which sent the message to Graylog) into the “source” field using a Copy Input extractor or a pipeline rule ([`set_field()`](http://docs.graylog.org/en/2.3/pages/pipelines/functions.html#set-field)).
---
### Author:  [@Mr\_Reyes](https://community.graylog.org/u/Mr_Reyes)
#### Post date: [October 3, 2017, 4:38pm UTC](https://community.graylog.org/t/parsing-syslog-messages/2667/3 "2017-10-03T16:38:24Z")
than!
im new to graylog, but i will give it a go
---
### Author:  [@Mr\_Reyes](https://community.graylog.org/u/Mr_Reyes)
#### Post date: [October 3, 2017, 4:56pm UTC](https://community.graylog.org/t/parsing-syslog-messages/2667/4 "2017-10-03T16:56:24Z")
hmmm any pointers, or ref to the documentation?
cant seem to figure out how to build the extractor (which field, and what type?)
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [October 3, 2017, 4:58pm UTC](https://community.graylog.org/t/parsing-syslog-messages/2667/5 "2017-10-03T16:58:10Z")
I mentioned the field names and the Extractor type in my first post…
> [@jochen](#):
>
> you could copy the content of the “gl2\_remote\_ip” field (which contains the IP address of the client which sent the message to Graylog) into the “source” field using a Copy Input extractor
---
### Author:  [@Mr\_Reyes](https://community.graylog.org/u/Mr_Reyes)
#### Post date: [October 4, 2017, 1:32pm UTC](https://community.graylog.org/t/parsing-syslog-messages/2667/6 "2017-10-04T13:32:55Z")
hmmm here is an example of the messages that does the problems:
i dont see the gl2\_remote\_ip field? or any other field i can extract the source ip from.
sorry for sounding n00b, but im all new to graylog
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [October 4, 2017, 3:12pm UTC](https://community.graylog.org/t/parsing-syslog-messages/2667/7 "2017-10-04T15:12:45Z")
Fields prefixed with “gl2\_” are hidden by default.
I’d recommend using a pipeline rule to to overwrite the “source” field.
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [October 18, 2017, 3:12pm UTC](https://community.graylog.org/t/parsing-syslog-messages/2667/8 "2017-10-18T15:12:57Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.