I have loginisght 4.3.0-5084751 installed.
I have two loginsight forwarders installed in two diffent location, which forward the logs to central cluster of loginsight servers.
The issue is the source IP will change to the IP address of forwarders when logs received by main cluster. I have configured even forwarding using Ingestion API. Based on documentation it should preserve sourece IP. but it doesn't
I have logged this issue with VMware support for weeks, but they are not being helpful at all!
This was by design (there was a doc bug) -- this issue is fixed in LI 4.5. If you upgrade, it will work as you outlined.