# Rename fields "source to "DC\_Name"

**URL:** <https://community.graylog.org/t/rename-fields-source-to-dc-name/26784>\
**Category:** Graylog Central (peer support)\
**Created:** [December 6, 2022, 1:39am UTC](https://community.graylog.org/t/rename-fields-source-to-dc-name/26784 "2022-12-06T01:39:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vsingh](https://avatars.discourse-cdn.com/v4/letter/v/b4bc9f/32.png) [@vsingh](https://community.graylog.org/u/vsingh)\
**Post date:** [December 6, 2022, 1:39am UTC](https://community.graylog.org/t/rename-fields-source-to-dc-name/26784/1 "2022-12-06T01:39:40Z")

</div>

Hello, I need to rename the field “source” to “DC\_Name”. I have used the pipeline code.

rule “rename\_field”  
when  
has\_field(“source”)  
then  
rename\_field(“source”,“DC\_Name”)  
end;

But it doesn’t work.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [December 6, 2022, 5:17am UTC](https://community.graylog.org/t/rename-fields-source-to-dc-name/26784/2 "2022-12-06T05:17:58Z")

</div>

Hello @vsingh && Welcome

Pipeline looks good, make sure Message Processors Configuration is correct.  
Pipeline Processor has to come after Message Filter chain.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/9bcac57e24478088b7818987b53c70fa7a7aca34.png)

BTW, I moved this post to the correct category. I believe this is a issue not Contest 😉

---

<div class="post-metadata">

**Author:** ![joe.gross](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/joe.gross/32/13372_2.png) [@joe.gross](https://community.graylog.org/u/joe.gross)\
**Post date:** [December 6, 2022, 10:31pm UTC](https://community.graylog.org/t/rename-fields-source-to-dc-name/26784/3 "2022-12-06T22:31:46Z")

</div>

“source” is a reserved field within Graylog meaning you cannot rename or get rid of it, same with “timestamp” and “message”. What you can do here is create a field called “DC\_Name” and assign that the same value as “source”, then edit your search screen to display “DC\_Name” as one of the columns on that page.

The rule would look something like:

```auto
rule "Set DC_Name to source value"
when
has_field("source")
then
set_field("DC_Name", to_string($message.source));
end

```

For modifying the search screen, select the down carrot in the upper right of the “All Messages” widget, then select “Edit”, and make your desired changes there.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 20, 2022, 10:32pm UTC](https://community.graylog.org/t/rename-fields-source-to-dc-name/26784/4 "2022-12-20T22:32:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.