Labels for both IP and hostname?

I’m using rsyslog to forward messages to promtail. Its default behavior is to use the HOSTNAME field from the source message, which is convenient, but some syslog senders don’t support this properly so I need to track their IP address to ensure uniqueness. Is there a way to use the IP for the host label and the hostname in another custom label like hostname ?

I can make a custom template in rsyslog that uses fromhost-ip instead, but I’d like to have both fields available. Maybe I could add the hostname as a custom structured data field?

I think you can set both as labels in promtail. If one of them end up being empty the promtail would just ignore it (the empty label would not be set).

I don’t see a way to pass the fromhost-ip from rsyslog to promtail. That’s not an available option in the docs. There is a field called __syslog_connection_ip_address but that is the IP address of the instance running promtail.

You’ll have to manipulate your log message. I think using template might get you want you need, and you can either put hostname in the log, or if that’s empty use IP for the field instead, and formt a new message with rsyslog template before forwarding to promtail.