F5 VIP as syslog destination on network devices

Elastic Stack Elasticsearch
1

We have all the network devices pointing to F5 Virtual server and under that server we have elastic nodes .

In elastic , we see logs but all of them have source as F5 Self IP, i have marked NAT as none on F5 VIP but still see souce IP in elastic as self IP.

Any thoughts , how this can be fixed ?

2

This needs to be fixed in the sender, has no relation to Elasticsearch, you need to check on F5 Bigip Forums.