Graylog2 / Graylog2/graylog2-server

Add option on Inputs to always set source to gl2_remote_ip

Open
#3,629 4 comments 2 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

I've got the problem, that some devices send non-standard syslog formats or similar, which makes Graylog use a weird value as source (the first word of the message). It would be nice to have an option to always use the IP-address instead of anything else, similar to the option _"Force rDNS"_, since we use the IPs of the devices as identifier anyway.
## Expected Behavior

Inputs should have an option to always use the IP-address (_gl2_remote_ip_) of the incoming packet(s) for the _source_ field.

## Current Behavior

The field containing the source IP is hidden by default and uses a different name than source. Naming consistency would not be given if this field is used. Currently, all messages pass a pipeline that sets the field _source_ to the value of _gl2_remote_ip_.

## Steps to Reproduce (for bugs)

1. Setup Syslog Input
2. Send Logs with invalid header (e.g. no hostname, facility, severity and timestamp)
3. Boom, unwanted value in _source_ field.

## Context

We use IP-addresses as identifying value for our entire environment. The devices do not own DNS entries, therefor this is not an option.

## Your Environment

* Graylog Version: 2.2.2
* Elasticsearch Version: 2.4.4
* MongoDB Version: v3.4.2
* Operating System: RHEL7
* Browser version: _various_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.