This post seems to ask a similar question. Unfortunately this is a limitation of how that network layer works and graylog is adding that field using the info it has available to it (what IP send the message). You would need to include that data in the message itself if you want it preserved or persisted.