We have a multi node farm with a separate backend server. I want to funnel the logs from which syslog-ng forwards into graylog via a load balancer on the graylog servers utilizing a second NIC. This will allow me to have the data more out of band while balancing the load. Unfortunately, when I use a global input, it appears to be tied to all NICs on the server. I know we can control to which IPs the web/API interfaces bind, but can we do that on a per server basis while having a global input type?
No that is currently not possible.
It would be a feature request for inputs to have the ability to add an array of possible IPs that the Input should bind itself.