# Source name in the Cisco Firepower Syslog

**URL:** <https://community.graylog.org/t/source-name-in-the-cisco-firepower-syslog/7735>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [November 20, 2018, 5:40pm UTC](https://community.graylog.org/t/source-name-in-the-cisco-firepower-syslog/7735 "2018-11-20T17:40:10Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![neeraj](https://avatars.discourse-cdn.com/v4/letter/n/e47c2d/32.png) [@neeraj](https://community.graylog.org/u/neeraj)\
**Post date:** [November 27, 2018, 4:39pm UTC](https://community.graylog.org/t/source-name-in-the-cisco-firepower-syslog/7735/11 "2018-11-27T16:39:36Z")

</div>

Hi Jan,  
Please see below sample message from our Cisco-ASA. My requirement is to correct the source field to show **"Cisco-ASA**" instead of “ **Nov** ” as what Graylog shows currently.

So, In order to fix / overwrite the source field of my incoming cisco syslog messages, i wrote the below 3 pipeline rules (per your advice on other similar [posts](https://community.graylog.org/t/making-source-field-show-hostname-instead-of-ip-address/7801/4) ) and tried each of them one by one yet none of them were able to overwrite the source field. The source in the messages still continues to show as **Nov** (month) Can you please help what is wrong with the below pipleline rules? Do we need to reboot or run `sudo graylog-ctl reconfigure` after adding pipeline rules for them take effect ?

```
rule "Correct CiscoASA hostname"
when
  has_field("local_facility") AND contains( "asa")
then
   set_field("source", "Cisco-ASA");
end

```

**OR**

```
    rule "Correct CiscoASA hostname"
    when
     has_field("source") AND contains( "Nov")
    then
      set_field("source", "Cisco-ASA");
    end

```

**OR**

```
rule "Correct CiscoASA hostname"
when
 contains(to_string($message.gl2_remote_ip), "192.168.1.10")
then
  set_field("source", "Cisco-ASA");
end

```

**Sample message:**

 ![Capture](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4f46092b52887429d305a18306a8fc31d807e258.jpeg)

---

_[View the full topic](https://community.graylog.org/t/source-name-in-the-cisco-firepower-syslog/7735)._