Mutate - replace source value

[achechen]

Thank you!

I have corrected the config as follows:

if [source] == "0:0:0:0:0:0:0:1" {
mutate {
  replace => [ "source", "%{syslog_hostname}" ]
  }
}

But logs are still coming into elasticsearch with 0:0:0:0:0:0:0:1 value in the source field.