# Migrating pipelines to ECS

**URL:** <https://discuss.elastic.co/t/migrating-pipelines-to-ecs/188756>\
**Category:** Elasticsearch\
**Tags:** ecs-elastic-common-schema\
**Created:** [July 3, 2019, 3:04pm UTC](https://discuss.elastic.co/t/migrating-pipelines-to-ecs/188756 "2019-07-03T15:04:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![javierE](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@javierE](https://discuss.elastic.co/u/javierE)\
**Post date:** [July 3, 2019, 3:04pm UTC](https://discuss.elastic.co/t/migrating-pipelines-to-ecs/188756/1 "2019-07-03T15:04:46Z")

</div>

Hello,

I am migrating my own pipeline according to the common scheme for apache events using as example the one provided by the apache module in filebeat and the ESC documentation.

in these, the source address of the requests is stored in the source.ip field

However, apache when it is behind a proxy logs 2 different ips.

What is the correct way to store these fields using ECS?

Is correct to use client.ip for the user's ip and  
source.ip for the proxy in this case ?

Other option is to store a list of ips in source.ip but i'm not sure if it is the best approach

Thanks in advance,  
Javier.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 4, 2019, 8:23am UTC](https://discuss.elastic.co/t/migrating-pipelines-to-ecs/188756/2 "2019-07-04T08:23:37Z")

</div>

You could use the `forwarded_ip` field? See [https://www.elastic.co/guide/en/ecs/1.0/ecs-network.html](https://www.elastic.co/guide/en/ecs/1.0/ecs-network.html)

--Alex

---

<div class="post-metadata">

**Author:** ![javierE](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@javierE](https://discuss.elastic.co/u/javierE)\
**Post date:** [July 5, 2019, 2:19pm UTC](https://discuss.elastic.co/t/migrating-pipelines-to-ecs/188756/3 "2019-07-05T14:19:57Z")

</div>

Yes! it is a good option!  
Thanks for pointing me out,

Regards  
Javier.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2019, 2:19pm UTC](https://discuss.elastic.co/t/migrating-pipelines-to-ecs/188756/4 "2019-08-02T14:19:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.