The logs forwarded from Aria Operations for Logs (Formerly vRealize Log Insight) are missing the original source and is showing the source as the IP address or hostname of Aria Operations for Logs when Syslog or Raw protocol is configured for log forwarding destinations.
Aria Operations for Logs 8.x
vRealize Log Insight 8.x
This is expected behavior and by design when using Syslog or Raw protocol. To preserve the original source in the 'source field' the protocol must be configured with Ingestion API (default protocol).
For reference see Add a VMware Aria Operations for Logs Log Forwarding Destination