Changing the source/host/hostname field

So I am ingesting logs using fluentd running on an AWS ECS Fargate sidecar container with Graylog… The fluentd container is using a type unix source to read from /var/run/fluent.sock.

I was not initially setting a field in the log messages that relates to hostname/host/source in the log message so I am trying to understand how Graylog populates the “source” field. Is this a field that is added by fluentd?

Currently the source is picking up the containers host name which is not very helpful and I would like to add a field that Graylog will use to populate source.

I have tried changing/adding the host, source and hostnames fields:

<filter foo-api.**>
  @type record_transformer
  <record>
    host "foo-api-#{Socket.gethostname}"
  </record>
</filter>

These never appear in the message that arrives in Graylog.

So this is my full configuration:

<source>
  @type unix
  path /var/run/fluent.sock
  tag foo-api
</source>

<filter foo-api.**>
  @type parser
  key_name log
  reserve_data false
  <parse>
    @type multi_format
    <pattern>
      format json
      time_key timestamp
    </pattern>
    <pattern>
      format none
    </pattern>
  </parse>
</filter>

<filter foo-api.**>
  @type record_transformer
  <record>
    ecs_container_id "foo-api-#{Socket.gethostname}"
  </record>
</filter>

<filter foo-api.**>
  @type record_transformer
  <record>
    host "foo-api-#{Socket.gethostname}"
  </record>
</filter>

<filter foo-api.**>
  @type record_modifier
  <replace>
    key source
    expression /.*/
    replace foo-api-testing
  </replace>
</filter>

<match foo-api.**>
  @type copy
  <store>
    @type gelf
    host graylog.dns.uk
    port 12201
    protocol tcp
    flush_interval 5s
  </store>
  <store>
    @type stdout
  </store>
</match>

Where I used source/host above I have also tried hostname. If I use any of those strings the new field is either not created or not modified but if I use random other key names they seem to work fine.

Graylog 3.2.6
fluentd:1.11.2
fluent-plugin-record-modifier 2.1.0
Alpine 3.13.5