We are looking to put either NGinx or HAProxy in front to provide some level of High Availability in regards to our syslog ingest. What we have noticed is to get syslog to work we use protocol TCP however all the messages then get logged as coming from NGinx or HAProxy, is there a trick to get it so it shows the originating box instead of the Load Balancer?
Logstash's tcp input supports v1 of the Proxy protocol that solves this problem. See http://www.haproxy.org/download/1.8/doc/proxy-protocol.txt.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.