Replace application_name

[kkplein]

Hi,

We have a syslog input, and I would like to replace the application_name from the generic “logger” to “myapp”, when the message has a specific source.

Would an “extractor” be the way to do this? What would be the simplest extrator to simply change “logger” into “myapp”, for syslog messages with a specific source?

[jochen]

You can change the content of a specific field in a pipeline rule: http://docs.graylog.org/en/2.4/pages/pipelines.html

Example:

rule "replace-app-name"
when
  has_field("application_name") && to_string($message.source) == "specific-source"
then
  set_field("application_name", "myapp");
end

[kkplein]

Super! What a powerful piece of software! We’re new users, and while we still have SO much to discover, we are amazed already. Thanks!