Replace application_name


(Kkplein) #1

Hi,

We have a syslog input, and I would like to replace the application_name from the generic “logger” to “myapp”, when the message has a specific source.

Would an “extractor” be the way to do this? What would be the simplest extrator to simply change “logger” into “myapp”, for syslog messages with a specific source?


(Jochen) #2

You can change the content of a specific field in a pipeline rule: http://docs.graylog.org/en/2.4/pages/pipelines.html

Example:

rule "replace-app-name"
when
  has_field("application_name") && to_string($message.source) == "specific-source"
then
  set_field("application_name", "myapp");
end

(Kkplein) #3

Super! What a powerful piece of software! We’re new users, and while we still have SO much to discover, we are amazed already. :slight_smile: Thanks!


(system) #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.