Send Log to Graylog but not show src address

[sokchen.m (Sokchen)]

Dear Support Team,

I have an issue with our device send logged to Graylog but not show src address. It show only timestamp “Oct”. Please kindly help check to configure below:

SW#sh run | in logg
logging buffered 409600
no logging console
logging facility local5
logging source-interface Vlan1
logging 10.10.10.1
ntp logging
SW#sh run | in time
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone

Thank for your support
BR,
Moeun Sokchen

[jan (Jan Doberstein)]

I guess that your messages are not following the syslog framework. But without sharing information what device you use or without sharing any information that is all just guessing,

[lmuir]

Looks like a Cisco. Try adding this to your Cisco config:
logging origin-id ip

More info: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/command/esm-xe-3se-5700-cr-book/esm-xe-3se-5700-cr-book_chapter_00.html

[shoothub]

I use workaround for such devices line switches, routers. So I simply change source to source ip of sending device using this pipeline rule:

rule "Set Source IP"
when
  has_field("message")
then
  set_field("source", to_string($message.gl2_remote_ip));
end