The forwarded.ip is the way to go. If you can't do this, you could
change your custom parsing to use, e.g., event.computer or a customer
client.device.ip for the second IP address.
For what we spend on our support contract, if an upgrade removes
functionality (the secondary server worked fine in 10.3) then telling us
we need a PS engagement to restore that functionality is not going to be
well received.
We have had multiple support tickets over this since we went to 10.4 and
have had conflicting and Just Plain Wrong information from support on
several occasions. Unfortunately, if the second server doesn't
participate in the trust model, then you hav...
