We have a syslog input, and I would like to replace the application_name from the generic “logger” to “myapp”, when the message has a specific source.
Would an “extractor” be the way to do this? What would be the simplest extrator to simply change “logger” into “myapp”, for syslog messages with a specific source?
You can change the content of a specific field in a pipeline rule: http://docs.graylog.org/en/2.4/pages/pipelines.html
has_field("application_name") && to_string($message.source) == "specific-source"
Super! What a powerful piece of software! We’re new users, and while we still have SO much to discover, we are amazed already. Thanks!
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.