Rsyslog forward using original source IP over TLS
Solution 1:
I'm not sure if this is sufficient, but the built-in template RSYSLOG_SyslogProtocol23Format is defined as
"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME%
%PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n"
and you can replace HOSTNAME by fromhost or fromhost-ip:
template(name="myFormat" type="string"
string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %fromhost% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n")
*.* @@(o)dest.syslog.example.com:6514;myFormat