How to get the IP address of the HTTP request sender using logstash?

magnusbaeck · March 17, 2017, 7:16am

I think host is the IP of the system that is running the Logstash.

The source code indicates otherwise.

logstash-plugins/logstash-input-http/blob/v3.0.3/lib/logstash/inputs/http.rb#L141


      
          
          # proc needs to be defined at this context
          # to capture @codecs, @logger and lowercase_keys
          p = Proc.new do |req|
            begin
              remote_host = req['puma.socket'].peeraddr[3]
              REJECTED_HEADERS.each {|k| req.delete(k) }
              req = lowercase_keys(req)
              body = req.delete("rack.input")
              @codecs.fetch(req["content_type"], @codec).decode(body.read) do |event|
                event.set("host", remote_host)
                event.set("headers", req)
                decorate(event)
                queue << event
              end
              ['200', @response_headers, ['ok']]
            rescue => e
              @logger.error("unable to process event #{req.inspect}. exception => #{e.inspect}")
              ['500', @response_headers, ['internal error']]
            end
          end

This is very easy for you to verify. If you have evidence that it really is the IP address of the local host then please present them.

Topic		Replies	Views
Get ip source TCP plugin Logstash	2	501	July 31, 2020
Http Input Plugin - basic question Logstash	5	450	May 20, 2020
How to get IP of machine in output? Logstash	4	1928	July 6, 2017
IP address of logstash node required in Logstash Metrics plugin Logstash	2	797	July 6, 2017
Logstash Syslog Input - Capture the Connecting Host's IP Address Logstash	5	697	June 14, 2023

How to get the IP address of the HTTP request sender using logstash?

Related topics