found this post , https://community.graylog.org/t/using-a-csv-lookup-table-within-a-pipeline/3707/13 , unsure why this is but, remove the rule from stage, went in maintenance on index, rotated then the reapplied original rule:
rule “iptoname”
when
has_field(“src_ip”)
then
let update_source = lookup_value(“ip_device_name”, to_string($message.src_ip));
set_field(“devicename”, update_source);
end
now its showing just the value:
devicename
homeassistant