diff --git a/app/ApiClients/GraylogApi.php b/app/ApiClients/GraylogApi.php
index 203150c1f7..bd303a9972 100644
--- a/app/ApiClients/GraylogApi.php
+++ b/app/ApiClients/GraylogApi.php
@@ -97,13 +97,14 @@ class GraylogApi
      */
     public function buildSimpleQuery(?string $search = null, ?Device $device = null): string
     {
+        $field = Config::get('graylog.query.field');
         $query = [];
         if ($search) {
             $query[] = 'message:"' . $search . '"';
         }
 
         if ($device) {
-            $query[] = 'source: ("' . $this->getAddresses($device)->implode('" OR "') . '")';
+            $query[] = $field . ': ("' . $this->getAddresses($device)->implode('" OR "') . '")';
         }
 
         if (empty($query)) {
diff --git a/app/Http/Controllers/Table/GraylogController.php b/app/Http/Controllers/Table/GraylogController.php
index d2190000e1..e6c14c3518 100644
--- a/app/Http/Controllers/Table/GraylogController.php
+++ b/app/Http/Controllers/Table/GraylogController.php
@@ -111,14 +111,16 @@ class GraylogController extends SimpleTableController
             $displayTime = $message['message']['timestamp'];
         }
 
-        $device = $this->deviceFromSource($message['message']['source']);
+        $origin = $this->deviceFromSource($message['message']['gl2_remote_ip']);
+        $source = $this->deviceFromSource($message['message']['source']);
         $level = $message['message']['level'] ?? '';
         $facility = $message['message']['facility'] ?? '';
 
         return [
+            'origin'    => $origin ? Url::deviceLink($origin) : htmlspecialchars($message['message']['gl2_remote_ip']),
             'severity'  => $this->severityLabel($level),
             'timestamp' => $displayTime,
-            'source'    => $device ? Url::deviceLink($device) : htmlspecialchars($message['message']['source']),
+            'source'    => $source ? Url::deviceLink($source) : htmlspecialchars($message['message']['source']),
             'message'   => htmlspecialchars($message['message']['message'] ?? ''),
             'facility'  => is_numeric($facility) ? "($facility) " . __("syslog.facility.$facility") : $facility,
             'level'     => (is_numeric($level) && $level >= 0) ? "($level) " . __("syslog.severity.$level") : $level,
diff --git a/includes/html/common/graylog.inc.php b/includes/html/common/graylog.inc.php
index df3e8de907..8bb51b394e 100644
--- a/includes/html/common/graylog.inc.php
+++ b/includes/html/common/graylog.inc.php
@@ -29,6 +29,7 @@ $tmp_output = '
         <thead>
             <tr>
             <th data-column-id="severity" data-sortable="false"></th>
+            <th data-column-id="origin">Origin</th>
             <th data-column-id="timestamp" data-formatter="browserTime">Timestamp</th>
             <th data-column-id="level">Level</th>
             <th data-column-id="source">Source</th>
diff --git a/includes/html/pages/device/logs.inc.php b/includes/html/pages/device/logs.inc.php
index 03353e2f4d..b0dae09144 100644
--- a/includes/html/pages/device/logs.inc.php
+++ b/includes/html/pages/device/logs.inc.php
@@ -57,7 +57,7 @@ if (\LibreNMS\Config::get('enable_syslog') == 1) {
     }
 }
 
-if (\LibreNMS\Config::get('graylog.port')) {
+if (\LibreNMS\Config::get('graylog.server')) {
     echo ' | ';
     if ($vars['section'] == 'graylog') {
         echo '<span class="pagemenu-selected">';
diff --git a/lang/en/settings.php b/lang/en/settings.php
index 0d212bdaad..360f090296 100644
--- a/lang/en/settings.php
+++ b/lang/en/settings.php
@@ -827,6 +827,12 @@ return [
                 'description' => 'Version',
                 'help' => 'This is used to automatically create the base_uri for the Graylog API. If you have modified the API uri from the default, set this to other and specify your base_uri.',
             ],
+            'query' => [
+                'field' => [
+                    'description' => 'Query api field',
+                    'help' => 'Changes the default field to query graylog API.',
+                ],
+            ],
         ],
         'html' => [
             'device' => [
diff --git a/misc/config_definitions.json b/misc/config_definitions.json
index 764b36c191..2d3fc45722 100644
--- a/misc/config_definitions.json
+++ b/misc/config_definitions.json
@@ -3763,6 +3763,13 @@
                 "other": "Other"
             }
         },
+        "graylog.query.field": {
+            "default": "source",
+            "type": "text",
+            "group": "external",
+            "section": "graylog",
+            "order": 10
+        },
         "group": {
             "type": "text",
             "default": "librenms"
diff --git a/resources/views/widgets/graylog.blade.php b/resources/views/widgets/graylog.blade.php
index e13dcc9c75..78922595a3 100644
--- a/resources/views/widgets/graylog.blade.php
+++ b/resources/views/widgets/graylog.blade.php
@@ -3,6 +3,7 @@
         <thead>
         <tr>
             <th data-column-id="severity" data-sortable="false"></th>
+            <th data-column-id="origin">{{ __('Origin') }}</th>
             <th data-column-id="timestamp" data-formatter="browserTime">{{ __('Timestamp') }}</th>
             <th data-column-id="level" data-sortable="false">{{ __('Level') }}</th>
             <th data-column-id="source">{{ __('Source') }}</th>