Using the following rewrite rule one can rewrite the HOST and HOSTNAME as the SOURCEIP of the logs which should mitigate the issue.
rewrite r_use_sourceip {
set("${SOURCEIP}", value("HOSTNAME"));
set("${SOURCEIP}", value("HOST"));
};
Once the rewrite rule has been created it needs to be referenced in the log statement before the destination statement as seen in the example below:
log {
source(s_example_source);
rewrite(r_use_sourceip);
destination(d_example_destination);
};