Replacing the Name in the Source Field

Graylog Central (peer support)
2

Hello,

  1. You probably didn’t use search very hard, check this topic:
    Change source name through pipeline example?

  2. Your rule condition has 2 problems: First you don’t use function to_string($message.source) which is neccesary. Second you use too specific condition, if you update firmware your condition will not match. I suggest to change condition to something more descriptive like:
    contains(to_string($message.source), "U7PG2,788a215xcaf5") or only
    contains(to_string($message.source), "788a215xcaf5") which is probably mac address of AP

  3. You can also use lookup table if you have many APs, create CSV file and use function lookup_value()