Graylog2 / Graylog2/graylog2-server
Add option on Inputs to always set source to gl2_remote_ip
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
I've got the problem, that some devices send non-standard syslog formats or similar, which makes Graylog use a weird value as source (the first word of the message). It would be nice to have an option to always use the IP-address instead of anything else, similar to the option _"Force rDNS"_, since we use the IPs of the devices as identifier anyway.
## Expected Behavior
Inputs should have an option to always use the IP-address (_gl2_remote_ip_) of the incoming packet(s) for the _source_ field.
## Current Behavior
The field containing the source IP is hidden by default and uses a different name than source. Naming consistency would not be given if this field is used. Currently, all messages pass a pipeline that sets the field _source_ to the value of _gl2_remote_ip_.
## Steps to Reproduce (for bugs)
1. Setup Syslog Input
2. Send Logs with invalid header (e.g. no hostname, facility, severity and timestamp)
3. Boom, unwanted value in _source_ field.
## Context
We use IP-addresses as identifying value for our entire environment. The devices do not own DNS entries, therefor this is not an option.
## Your Environment
* Graylog Version: 2.2.2
* Elasticsearch Version: 2.4.4
* MongoDB Version: v3.4.2
* Operating System: RHEL7
* Browser version: _various_
Contributor guide
Assessment
This issue has not been assessed yet.