# Replacing the Name in the Source Field

**URL:** <https://community.graylog.org/t/replacing-the-name-in-the-source-field/12447>\
**Category:** Graylog Central (peer support)\
**Created:** [October 18, 2019, 9:21pm UTC](https://community.graylog.org/t/replacing-the-name-in-the-source-field/12447 "2019-10-18T21:21:18Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [October 21, 2019, 7:52am UTC](https://community.graylog.org/t/replacing-the-name-in-the-source-field/12447/2 "2019-10-21T07:52:32Z")

</div>

Hello,

1. You probably didn’t use search very hard, check this topic:  
[Change source name through pipeline example?](https://community.graylog.org/t/change-source-name-through-pipeline-example/5459/6)

2. Your rule condition has 2 problems: First you don’t use function to\_string($message.source) which is neccesary. Second you use too specific condition, if you update firmware your condition will not match. I suggest to change condition to something more descriptive like:  
`contains(to_string($message.source), "U7PG2,788a215xcaf5")` or only  
`contains(to_string($message.source), "788a215xcaf5")` which is probably mac address of AP

3. You can also use lookup table if you have many APs, create CSV file and use function `lookup_value()`

---

_[View the full topic](https://community.graylog.org/t/replacing-the-name-in-the-source-field/12447)._