# How to store iis x-forwarded-for ip with field type IPORHOST **URL:** \ **Category:** Elasticsearch\ **Created:** [October 24, 2020, 12:42am UTC](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186 "2020-10-24T00:42:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Thanura\_Kannangara](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Post date:** [October 24, 2020, 12:42am UTC](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186/1 "2020-10-24T00:42:48Z")
I'm trying to grok these entries ```auto #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken X-Forwarded-For 2020-10-23 19:35:15 10.10.10.73 GET /some/path/here.exe - 443 - 10.10.10.124 ELB-HealthChecker/2.0 - 200 0 0 182 - 2020-10-23 19:35:24 10.10.10.73 GET / - 443 - 10.10.10.11 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:81.0)+Gecko/20100101+Firefox/81.0 - 302 0 0 110 8.8.8.9 ``` If I use something like this `%{IPORHOST:iis.access.xforwardedfor}` for `X-Forwarded-For` it fails with below error. `"type"=>"illegal_argument_exception", "reason"=>"'-' is not an IP string literal."` Because is sends `-` for some requests. How can i meet my need. If the value for `X-Forwarded-For` is '-' I'm ok to simply drop the field. My end goal is if i see a real IP for `X-Forwarded-For` i need to store it in a field with correct field type of `IPORHOST` ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [October 24, 2020, 1:34am UTC](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186/2 "2020-10-24T01:34:23Z")
> [@Thanura\_Kannangara](#): > > Because is sends `-` for some requests. You should replace this value by an empty content. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 24, 2020, 7:41am UTC](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186/3 "2020-10-24T07:41:46Z")
I do not have the exact syntax at hand, but can typically modify the pattern to either match `IPORHOST` or `-` (not captured), possibly something like this: `(%{IPORHOST:iis.access.xforwardedfor}|-)` ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [October 24, 2020, 1:04pm UTC](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186/4 "2020-10-24T13:04:59Z")
That's even better! 😉 ---
**Author:** ![Thanura\_Kannangara](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Post date:** [October 26, 2020, 6:16pm UTC](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186/5 "2020-10-26T18:16:31Z")
Thanks this worked ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 23, 2020, 6:16pm UTC](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186/6 "2020-11-23T18:16:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.