Pipeline Rule not working - Source replace with grok

Graylog Central (peer support)
5

Thank you, I tried both your suggestions and the source is still showing up as the IPV6 address rather than the hostname. I feel like I’m doing something fundamentally wrong. My goal it to search the message and then replace the source with what I found in the message.

1st Recommendation:
GROK Pattern “FQDN” = “\s%{HOSTNAME}”

rule "FQDN to Source"
when
  has_field("message")
then
 let extract = grok(pattern: "%{FQDN}", value: to_string($message.source));
 set_fields(extract);
end

2nd recommendation:

rule "FQDN to Source"
when
  has_field("message")
then
 let extract = grok(pattern: "^/S %{HOSTNAME}", value: to_string($message.source));
 set_fields(extract);
end