Replace application_name


We have a syslog input, and I would like to replace the application_name from the generic “logger” to “myapp”, when the message has a specific source.

Would an “extractor” be the way to do this? What would be the simplest extrator to simply change “logger” into “myapp”, for syslog messages with a specific source?

You can change the content of a specific field in a pipeline rule:


rule "replace-app-name"
  has_field("application_name") && to_string($message.source) == "specific-source"
  set_field("application_name", "myapp");

Super! What a powerful piece of software! We’re new users, and while we still have SO much to discover, we are amazed already. :slight_smile: Thanks!

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.