I don't think that it's just displaying the wrong origin, I think it's discarding the origin.
Our intention is to use rsyslog to collect at remote sites and then forward to kiwi & logstash, but I don't know that it's going to work if this is a problem. FWIW, Logstash shows the correct origin.