Add custom field on IIS log

Elastic Stack Beats
1

Hi everybody!
I added a custom field on IIS log to register the original client IP (x-forwarded-for). This is necessary because I use a reverse proxy to publish my webserver, so the Client IP Address (c-ip) show only the reverse proxy IP.
How can I send this new field in Elasticsearch? I use Filebeat to read me IIS logs; how to add this custom field?
Here is the new header of IIS log file after I added the custom field and two lines of the generated log:

#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken ClientIpHeader
2020-11-19 23:59:42 10.22.1.6 POST /cpv/xxxx.svc - 80 - 10.21.0.4 Mozilla/4.0+(compatible;+Cache;) - 200 0 0 56 177.184.206.230:59817
2020-11-19 23:59:42 10.22.1.6 POST /bgn/xxxx.svc - 80 - 10.21.0.4 Mozilla/4.0+(compatible;+Cache;) https://yyyyy.com:443/xxx/xxxx.svc 200 0 0 38 187.72.8.165:53602

I will apreciate any help!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.