Use source IP for source field

Templates and Rules Exchange Pipeline Rules
1

Sometimes if you send syslog messages from device which don’t follow syslog RFC, you end up with inappropriate source field extracted. This usually happen on network devices like cisco, which have own syslog format.

This simple pipeline rule replaces source field with IP address of sending device. It uses graylog’s internal field gl2_remote_ip which contains IP of sending device. Best way to use this pipeline rule is to put it on pipeline which process only problematic device.

rule "Replace source with sending IP"
when
  has_field("message")
then
  set_field("source", to_string($message.gl2_remote_ip));
end

Please note that this solution is not recommended if you use load balancer or central log forwarder as all messages would have same ip.

5 Likes