Send Log to Graylog but not show src address

Dear Support Team,

I have an issue with our device send logged to Graylog but not show src address. It show only timestamp “Oct”. Please kindly help check to configure below:

SW#sh run | in logg
logging buffered 409600
no logging console
logging facility local5
logging source-interface Vlan1
ntp logging
SW#sh run | in time
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone

Thank for your support
Moeun Sokchen

I guess that your messages are not following the syslog framework. But without sharing information what device you use or without sharing any information that is all just guessing,

Looks like a Cisco. Try adding this to your Cisco config:
logging origin-id ip

More info:

I use workaround for such devices line switches, routers. So I simply change source to source ip of sending device using this pipeline rule:

rule "Set Source IP"
  set_field("source", to_string($message.gl2_remote_ip));

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.