Preserve original IP-Adress via nginx (Proxy Protocol)

Graylog Central (peer support)
1

Can anyone help with this?
I have 3 Graylog Nodes. Infront of them there is a Nginx (free version) Active-Passive Cluster Load Balancers (2 Servers).

I am getting messages where the “gl2_remote_ip” shows the one of the load balancer ips. Did someone encounter this as well and was able to solve this?

How can I get the original IP-Adress of the sources? Does nginx proxy protocol help? If so, how could I implement it, maybe with an example? From the documentation of nginx of proxy protocol, I am not able to make it work.

Thanks

2

This post seems to ask a similar question. Unfortunately this is a limitation of how that network layer works and graylog is adding that field using the info it has available to it (what IP send the message). You would need to include that data in the message itself if you want it preserved or persisted.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.