# Rename SNMP input fields **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [March 9, 2022, 9:47am UTC](https://community.graylog.org/t/rename-snmp-input-fields/22955 "2022-03-09T09:47:55Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Majdoline](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Majdoline](https://community.graylog.org/u/Majdoline)\ **Post date:** [March 9, 2022, 9:47am UTC](https://community.graylog.org/t/rename-snmp-input-fields/22955/1 "2022-03-09T09:47:55Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. **Don’t forget to select tags to help index your topic!** **1. Describe your incident:** i can’t rename SNMP UDP input fields after translate them with MIBs files **2. Describe your environment:** - OS Information: Ubuntu 18.04.3 - Package Version: Graylog 3.1.3 - Service logs, configurations, and environment variables: SNMP UDP input **3. What steps have you already taken to try and solve the problem?** ```auto rule "rename_field" when has_field("snmp_1_3_6_1_4_1_2011_2_15_1_7_1_1_0") AND contains(to_string($message.gl2_source_input), "62161baa49885931b58ba41f", true) then rename_field("snmp_1_3_6_1_4_1_2011_2_15_1_7_1_1_0","alarm_source"); end ``` or ```auto rule "rename_field" when has_field("snmp_1_3_6_1_4_1_2011_2_15_1_7_1_1_0") AND contains(to_string($message.gl2_source_input), "62161baa49885931b58ba41f", true) the let alarm_source = to_string($message.snmp_1_3_6_1_4_1_2011_2_15_1_7_1_1_0); set_field("alarm_source", alarm_source); ``` **4. How can the community help?** **Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab] ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [March 9, 2022, 3:34pm UTC](https://community.graylog.org/t/rename-snmp-input-fields/22955/2 "2022-03-09T15:34:18Z")
Are you sure the message has a `gl2_source_input` field? Also, it always helps if you post the original message… and use the `` tool around code to make it readable… (I did `` for you) You could use the `debug()` function to figure out what is going on in your rule: ```auto rule "rename_field" when has_field("snmp_1_3_6_1_4_1_2011_2_15_1_7_1_1_0") AND contains(to_string($message.gl2_source_input), "62161baa49885931b58ba41f", true) then debug("=================================================================================================================="); debug(concat("++++ my gl2 field should have 62161baa49885931b58ba41f in it: ",to_string($message.gl2_source_input))); debug(concat("++++ my snmp field contains: ",to_string($message.snmp_1_3_6_1_4_1_2011_2_15_1_7_1_1_0))); // rename_field("snmp_1_3_6_1_4_1_2011_2_15_1_7_1_1_0","alarm_source"); // debug(concat("++++ my NEW field contains: ",to_string($message.alarm_source))); debug("=================================================================================================================="); end ``` Then watch what happens in your Graylog log file: `tail -f /var/log/graylog-server/server.log` ---
**Author:** ![Majdoline](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Majdoline](https://community.graylog.org/u/Majdoline)\ **Post date:** [March 13, 2022, 11:21am UTC](https://community.graylog.org/t/rename-snmp-input-fields/22955/3 "2022-03-13T11:21:17Z")
many thanks… by debug our rule we found as below that the message went to pipeline before translating with their MIBs 2022-03-13T13:15:02.385+02:00 INFO [Function] PIPELINE DEBUG: ================================================================================================================== 2022-03-13T13:15:02.385+02:00 INFO [Function] PIPELINE DEBUG: ++++ my gl2 field should have 62161baa49885931b58ba41f in it: 62161baa49885931b58ba41f 2022-03-13T13:15:02.385+02:00 INFO [Function] PIPELINE DEBUG: ++++ my snmp field contains: 2022-03-13T13:15:02.385+02:00 INFO [Function] PIPELINE DEBUG: ++++ my NEW field contains: 2022-03-13T13:15:02.385+02:00 INFO [Function] PIPELINE DEBUG: ================================================================================================================== by the way our Message Processors Configuration is as below: | # | Processor | Status | | --- | --- | --- | | 1 | AWS Instance Name Lookup | active | | 2 | Message Filter Chain | active | | 3 | Pipeline Processor | active | | 4 | GeoIP Resolver | disabled | ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [March 14, 2022, 2:26am UTC](https://community.graylog.org/t/rename-snmp-input-fields/22955/4 "2022-03-14T02:26:18Z")
Great! Mark it as the answer for future searchers!! 🙂 ---
**Author:** ![Majdoline](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Majdoline](https://community.graylog.org/u/Majdoline)\ **Post date:** [March 14, 2022, 7:44am UTC](https://community.graylog.org/t/rename-snmp-input-fields/22955/5 "2022-03-14T07:44:34Z")
Sorry but it still not solved, as i mentioned : by debug our rule we found that the message went to pipeline before translating with their MIBs **i need to solution to change the name of attribute comes from MIBs files** ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [March 14, 2022, 12:12pm UTC](https://community.graylog.org/t/rename-snmp-input-fields/22955/6 "2022-03-14T12:12:39Z")
OK, not the answer, I had thought “many thanks” meant it was. It is not clear to me what you are explaining. I don’t know what pipeline you are speaking of, the one with the rule or another one? If the fields are not there in the debug rule I posted then either it is not there at that point and you need to shift your change field rules somewhere else or figure out why those fields not there. I do not know anything about the flow of your data, what it looks like coming in or what is actually in the message until you post it. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [March 28, 2022, 12:13pm UTC](https://community.graylog.org/t/rename-snmp-input-fields/22955/7 "2022-03-28T12:13:09Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.