And while that isn't "wrong", it's not really what source was meant for.
From the docs:
Source -
A default field that identifies the source of the event. In the case of data monitored from files and directories, source consists of the full pathname of the file or directory. In the case of a network-based source, the source field consists of the protocol and port, such as UDP:514.
... View more