Hi,
We are using our graylog server (2.3.0 rc2) behind a mikrotik router with nat rules.
One NAT rule for our running application’s GELF ip and port
One NAT rule for graylog web interface (graylog box port 80)
One NAT rule for graylog api interface (graylog box port 9000)
everything works fine except remote ip
Why every new log’s remote ip value is getting our mikrotik router’s internal ip ?
Is there a setting to fix this problem ?
did you talk about the field “remote ip” that is created when it is not provided in the GELF messages? Or did you refer to the fact that every authenticated user is shown as coming from the Mikrotik Router?
Please be a little more verbose and you might get help.