# Source Name Identification **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules\ **Created:** [March 22, 2017, 12:17pm UTC](https://community.graylog.org/t/source-name-identification/534 "2017-03-22T12:17:19Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![mr\_m\_cox](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@mr\_m\_cox](https://community.graylog.org/u/mr_m_cox)\ **Post date:** [March 22, 2017, 12:17pm UTC](https://community.graylog.org/t/source-name-identification/534/1 "2017-03-22T12:17:19Z")
Hi All, I have got graylog configured to get both Windows Event Log and IIS logs. The problem I have is that it is showing two different sources, The IIS source is the machine name and the Event Logs are the FQDN of the server ([machinename.domain.com](http://machinename.domain.com)). How can I get it to use one or the other for all logs from a given server, irrelevant of source within that server? Thanks. ---
**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\ **Post date:** [March 22, 2017, 1:22pm UTC](https://community.graylog.org/t/source-name-identification/534/2 "2017-03-22T13:22:36Z")
you can always set source field with an extractor (you can emulate simple if with conditional extraction) or pipeline rule ---
**Author:** ![mr\_m\_cox](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@mr\_m\_cox](https://community.graylog.org/u/mr_m_cox)\ **Post date:** [March 22, 2017, 1:27pm UTC](https://community.graylog.org/t/source-name-identification/534/3 "2017-03-22T13:27:33Z")
Hi, Thanks for the reply. That sounds great, could you explain a little more or link to a good doc about this Thanks. ---
**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\ **Post date:** [March 22, 2017, 1:45pm UTC](https://community.graylog.org/t/source-name-identification/534/4 "2017-03-22T13:45:15Z")
In my case, due to deployment through docker and it’s internal network magic my UTMs got mixed up and had weird IP’s in their source field, but I was able to identify each by other data like serial number etc, so i made couple extractors, one for each UTM, which are assigning some arbitrary text to `source` field, like `fw1`, `fw2` basing on existence of `sn=serialnumber` text in `message` field, so you can make a “Replace with regular expression” type extractor for `source` field, selecting “Only attempt extraction if field contains string” and insert source name you want to change, “.\*” in “Regular expression” field and desired source name in “Replacement” field, that’s all ---
**Author:** ![mr\_m\_cox](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@mr\_m\_cox](https://community.graylog.org/u/mr_m_cox)\ **Post date:** [March 22, 2017, 1:49pm UTC](https://community.graylog.org/t/source-name-identification/534/5 "2017-03-22T13:49:41Z")
OK, so will that mean that on the sources page my listed “Selected Sources” wont duplicate or will it still see two? ---
**Author:** ![mr\_m\_cox](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@mr\_m\_cox](https://community.graylog.org/u/mr_m_cox)\ **Post date:** [March 22, 2017, 1:50pm UTC](https://community.graylog.org/t/source-name-identification/534/6 "2017-03-22T13:50:44Z")
I can answer that, I now have 4! name name.domain name.domain name.domain.domain ---
**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\ **Post date:** [March 22, 2017, 1:52pm UTC](https://community.graylog.org/t/source-name-identification/534/7 "2017-03-22T13:52:55Z")
sources page lists things from `source` field of your messages, so setting this field for all future messages to desired name means you’ll see only desired name in this page ---
**Author:** ![mr\_m\_cox](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@mr\_m\_cox](https://community.graylog.org/u/mr_m_cox)\ **Post date:** [March 22, 2017, 1:59pm UTC](https://community.graylog.org/t/source-name-identification/534/8 "2017-03-22T13:59:36Z")
ok cool, thanks. Anyway to purge the sources on demand to clear any that no longer exist? I assume with the extractor in place it should clear some. ---
**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\ **Post date:** [March 22, 2017, 2:06pm UTC](https://community.graylog.org/t/source-name-identification/534/9 "2017-03-22T14:06:21Z")
by default it shows last hour’s messages’ sources, extractors doesn’t work with old messages (no way to change past messages), so if you fixed the problem with ( **working** ) extractortor you can get rid of old source names by deleting old messages or just wait ---
**Author:** ![mr\_m\_cox](https://avatars.discourse-cdn.com/v4/letter/m/53a042/32.png) [@mr\_m\_cox](https://community.graylog.org/u/mr_m_cox)\ **Post date:** [March 22, 2017, 2:10pm UTC](https://community.graylog.org/t/source-name-identification/534/10 "2017-03-22T14:10:06Z")
The problem I am having is that the extractor is applying to both- name name.domain meaning I end up with name.domain.domain. ---
**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\ **Post date:** [March 22, 2017, 2:25pm UTC](https://community.graylog.org/t/source-name-identification/534/11 "2017-03-22T14:25:21Z")
because it matches both occurrences, try regular expression condition, be sure to create expression matching only one occurrence, without “.domain”