# How to change sender

**URL:** <https://discuss.elastic.co/t/how-to-change-sender/50069>\
**Category:** Logstash\
**Created:** [May 15, 2016, 8:54am UTC](https://discuss.elastic.co/t/how-to-change-sender/50069 "2016-05-15T08:54:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![netsuro](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@netsuro](https://discuss.elastic.co/u/netsuro)\
**Post date:** [May 15, 2016, 8:54am UTC](https://discuss.elastic.co/t/how-to-change-sender/50069/1 "2016-05-15T08:54:51Z")

</div>

Hello,

I am new in using logstash.  
I would just like to change the sender.

My conf file is very basic :

> input {  
> file {  
> path =\> "/srv/log/_/_"  
> start\_position =\> "beginning"  
> }  
> }

> output {  
> gelf {  
> host =\> ["localhost"]  
> port =\> "5514"  
> }  
> }

I would like to send either the name of the parent folder (the first star) that hosts the file or the hostname that is in the message sent (which are centos system logs).

I have try different filter but i dont find solution.

Thank you for your help.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 15, 2016, 11:20am UTC](https://discuss.elastic.co/t/how-to-change-sender/50069/2 "2016-05-15T11:20:03Z")

</div>

The path of the input file will be stored in the `path` field of each event. You can use a grok filter to extract whatever part of the filepath that you're interested in.

You'd typically also use a grok filter to parse the logs and extract interesting pieces of information, like the hostname. If "CentOS system logs" means syslog files there are examples of how to parse those in the Logstash documentation.

---

<div class="post-metadata">

**Author:** ![netsuro](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@netsuro](https://discuss.elastic.co/u/netsuro)\
**Post date:** [May 15, 2016, 1:10pm UTC](https://discuss.elastic.co/t/how-to-change-sender/50069/3 "2016-05-15T13:10:44Z")

</div>

Ok, thanks for this idea.

It's better but my source = the host server (where there is the file), good hostname

how to delete the host server name ?  
I test with mutate but it did not work, my fault i suppose.

My code :

> input {  
> file {  
> type =\> "syslog"  
> path =\> "/srv/log/_/_"  
> start\_position =\> "beginning"  
> }  
> }  
> filter {  
> if [type] == "syslog" {  
> grok {  
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{IPORHOST:host} "  
> }  
> }  
> }  
> }  
> output {  
> gelf {  
> host =\> ["localhost"]  
> port =\> "5514"  
> sender =\> "%{host}"  
> }  
> }

---

<div class="post-metadata">

**Author:** ![netsuro](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@netsuro](https://discuss.elastic.co/u/netsuro)\
**Post date:** [May 15, 2016, 2:06pm UTC](https://discuss.elastic.co/t/how-to-change-sender/50069/4 "2016-05-15T14:06:45Z")

</div>

Ok i found

my code :

> input {  
> file {  
> type =\> "syslog"  
> path =\> "/srv/log/_/_"  
> start\_position =\> "beginning"  
> }  
> }  
> filter {  
> if [type] == "syslog" {  
> grok {  
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{IPORHOST:hostname}"  
> }  
> }  
> }  
> }  
> output {  
> gelf {  
> host =\> ["localhost"]  
> port =\> "5514"  
> sender =\> "%{hostname}"  
> }  
> }

"host" was bad variable

thank you for guiding me

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/how-to-change-sender/50069/5 "2017-07-06T04:57:32Z")

</div>

Closed on July 6, 2017, 4:57am UTC