This post seems to ask a similar question. Unfortunately this is a limitation of how that network layer works and graylog is adding that field using the info it has available to it (what IP send the message). You would need to include that data in the message itself if you want it preserved or persisted.
drewmiranda-gl
(Drew Miranda)
2
Related topics
| Topic | Replies | Views | Activity | |
|---|---|---|---|---|
| Graylog with NGINX udp proxy, keep source ip | 1 | 912 | November 5, 2020 | |
| Gl2_remote_ip always 127.0.0.1 when using nginx reverse proxy | 4 | 2753 | March 21, 2017 | |
| Load balancing nginx with ip private in LAN | 2 | 2451 | April 3, 2017 | |
| Loadbalancer on Gelf TCP input source IP | 1 | 661 | July 3, 2020 | |
| Best practice - Loadbalancer | 4 | 2717 | January 7, 2022 |