# CloudFlare X-Forwarded-For Real Source IP **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 6, 2020, 8:21am UTC](https://discuss.elastic.co/t/cloudflare-x-forwarded-for-real-source-ip/239973 "2020-07-06T08:21:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [July 6, 2020, 8:21am UTC](https://discuss.elastic.co/t/cloudflare-x-forwarded-for-real-source-ip/239973/1 "2020-07-06T08:21:46Z")
Hi, I'm new to Elastic and need help to find the real IP of nginx site visitor. The environment I have is Nginx module installed in Filebeat and reading the data passed via logstash to elasticsearch and viewed in kibana. The site I have is proxied via Cloudflare, and as the documentation says here: ```auto https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-nginx.html ``` Is that (nginx.access.remote\_ip\_list) will read the X-Forwarded-For (which is the real ip of visitor and not cloudflare's IP) But when checking this field in kibana, it gives Cloudflare's IP. What shall I do to get the Real visitor IP? Regards, ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [July 6, 2020, 6:40pm UTC](https://discuss.elastic.co/t/cloudflare-x-forwarded-for-real-source-ip/239973/2 "2020-07-06T18:40:18Z")
What version of Filebeat are you using? The documentation also says: > Real source IP is restored to `source.ip` . Have you checked the `source.ip` field in Kibana? Shaunak ---
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [July 7, 2020, 5:11am UTC](https://discuss.elastic.co/t/cloudflare-x-forwarded-for-real-source-ip/239973/3 "2020-07-07T05:11:59Z")
Filebeat 7.8, and yes checked the `source.ip ` and it is sending cloud-flare's IP. ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [July 7, 2020, 12:43pm UTC](https://discuss.elastic.co/t/cloudflare-x-forwarded-for-real-source-ip/239973/4 "2020-07-07T12:43:25Z")
Can you post a sample line from your Nginx log and point out which one is the cloudflare IP and which one is the IP of the visitor in that line? Also please post your complete `filebeat.yml` and `modules.d/nginx.yml` (with any sensitive information redacted). Then I can try to reproduce your scenario on my end. Thanks, Shaunak ---
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [July 8, 2020, 7:50am UTC](https://discuss.elastic.co/t/cloudflare-x-forwarded-for-real-source-ip/239973/5 "2020-07-08T07:50:45Z")
Hi, In order to solve this issue, I've changed the nginx config file to list real Ip's instead of cloudflare. I've used this as a turn around. Here are the steps used. > **[Getting Real IP Addresses Using CloudFlare, Nginx, and Varnish | Daniel Miessler](https://danielmiessler.com/blog/getting-real-ip-addresses-using-cloudflare-nginx-and-varnish/)** > > March 6, 2012 CloudFlare is a great service that proxies your site's traffic in order to offer performance gains and filtering options. It can compress The logs in nginx were only listing CD ip's and not both real and CD's Ip's Regards, ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 5, 2020, 9:50am UTC](https://discuss.elastic.co/t/cloudflare-x-forwarded-for-real-source-ip/239973/6 "2020-08-05T09:50:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.