Hi, newbie on elastic here,
I have several applications run on kubernetes.
I am trying to get the real ips that comes from loadbalancer but all I see is the loadbalancer IP.
{ "_index": "application-dev-2024.04.15", "_type": "_doc", "_id": "ofyp4Y4BezWxmQ3Cd4V5", "_version": 1, "_score": null, "_source": { "@timestamp": "2024-04-15T15:09:24.4118670+03:00", "level": "Information", "messageTemplate": "HTTP Request {RequestMethod} {RequestPath} responded {StatusCode} in {Elapsed:0.0000} ms", "message": "HTTP Request \"POST\" \"/DXXRDV\" responded 200 in 8772.7179 ms", "fields": { "Host": "derbis.dernekler.gov.tr", "Protocol": "HTTP/1.1", "Scheme": "https", "IpAddress": "10.0.141.252", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36", "ContentType": "application/json", "RequestId": "0HN2LFGG6THHS:00000003", "ConnectionId": "0HN2LFGG6THHS", "EndpointName": "HVL.DRF.Application.Reporting.v1.Controllers.CustomWebDocumentViewerController.Invoke (HVL.DRF.Application)", "AuthContext": { "_typeTag": "AuthContext", "AllActorsIds": [], "UserActorId": "a5429c67-9d39-4adf-acc0-17df13efafed", "ApplicationPermissionCodes": [], "Token": "eyJ***OhQ", "DelegatedFromActorId": null }, "Type": "RequestLog", "RequestMethod": "POST", "RequestPath": "/DXXRDV", "StatusCode": 200, "Elapsed": 8772.717866, "SourceContext": "Serilog.AspNetCore.RequestLoggingMiddleware", "Environment": "DerbisProdK8S", "Application": "derbis-drf" }, "renderings": { "Elapsed": [ { "Format": "0.0000", "Rendering": "8772.7179" } ] } }, "fields": { "@timestamp": [ "2024-04-15T12:09:24.411Z" ] }, "sort": [ 1713182964411 ] }
10.0.141.252 is my loadbalancer IP, x.x.x.x is the real ip
I can see the real ip from my nginx pod logs. I installed a pod calls echoserver and it returns an output like this.
user-agent=Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0
x-forwarded-for=x.x.x.x, 10.42.3.143, 10.0.146.152
x-forwarded-host=example.com.de
x-forwarded-port=443
x-forwarded-proto=https
x-forwarded-scheme=https
x-forwarded-uri=/api/v1/namespaces/default/services/http:clusterip:80/proxy/
x-real-ip=x.x.x.x
x-request-id=87dbeef61cf157894b0c40c65a373d92
x-scheme=https
BODY:
-no body in request-
How can I configure elastic or kibana to show the real ip?