We have syslog collection setup with Kiwi as first syslog collection point and Solarwinds Orion running behind Kiwi as 2nd syslog point. Kiwi will forward only filtered message to Solarwinds.
Linux client will sent syslog messages to Load balancer IP, and LB will forward it to available kiwi server, Due to which at KSS, the source Ip of the syslog messages mostly will be the Load balancer IP. In order to correct this, we have directed Kiwi to update the hostname from the 4th argument from syslog message, using script. And it is working as expected
But when we forward this message to Solarwinds, by default the Source IP --> Load balancer Ip is getting mapped in LA console.
P.s : We already enabled retain ip property in Kiwi.
Looking for some directions here