Graylog with NGINX udp proxy, keep source ip

Graylog Central (peer support)
1

Hallo.

I stumbled across Graylog, and wanted to give it a try.

I setup the server, with a NGINX stream proxy in front of it, everything is working perfect. But all my syslog i receive gets the NGINX-servers ip as the source.

How do i keep the source adress from my (example) ASA firewall instead. I cant seem to fingure it out. My NGINX i very simple as follows:

stream {
server {
listen 514 udp:

	proxy_pass 10.10.10.20:10514;
	}

}

2

If hostname is directly in Syslog message, you can extract it and replace source field with it using pipeline rule. If there is no hostname in syslog, graylog can use address sending logs. Please post your example message, and how do you parse it?