# Nginx & proxies

**URL:** <https://discuss.elastic.co/t/nginx-proxies/85757>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 15, 2017, 11:49am UTC](https://discuss.elastic.co/t/nginx-proxies/85757 "2017-05-15T11:49:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sepal](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@sepal](https://discuss.elastic.co/u/sepal)\
**Post date:** [May 15, 2017, 11:49am UTC](https://discuss.elastic.co/t/nginx-proxies/85757/1 "2017-05-15T11:49:18Z")

</div>

I've just setup filebeat for an existing elastic stack primarily to analyze the the access logs from nginx. I used the setup command and it all went ok without any problems. I've encoutered one issue in the index data though, which I'm not sure how it could be fixed.  
The site uses several proxies infront of nginx, which means that nginx will write the IPs from the `X-Forward-For` header into the access log. A line in there therefore basically looks like this:

```auto
client_ip, proxy1_ip, proxy2_ip - - [date] "message"

```

It seems like filebeat only extracts the `proxy2_ip` address. Is there a way to extract the left most address i.e. the `client_ip`?  
I looked into the nginx module in the filebeat repo and saw that grok extracts the IP using the pattern `%{IPORHOST:nginx.access.remote_ip}`. I tried that on the tools mentioned in the [grok](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) documentation and there it extracted the correct IP, so did I miss something?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 16, 2017, 6:47am UTC](https://discuss.elastic.co/t/nginx-proxies/85757/2 "2017-05-16T06:47:25Z")

</div>

Looking at our grok pattern for the nginx access logs it currently supports only 1 IP address. Could you open a feature request on [https://github.com/elastic/beats](https://github.com/elastic/beats) for support of multiple ip adresses? Please share there also some "real" log output as this will make it much easier for us to test it.

---

<div class="post-metadata">

**Author:** ![sepal](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@sepal](https://discuss.elastic.co/u/sepal)\
**Post date:** [May 16, 2017, 7:23am UTC](https://discuss.elastic.co/t/nginx-proxies/85757/3 "2017-05-16T07:23:12Z")

</div>

Yes I can, although initially it would already be good, to just get the client IP, which ist the first one in the list.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 16, 2017, 12:28pm UTC](https://discuss.elastic.co/t/nginx-proxies/85757/4 "2017-05-16T12:28:35Z")

</div>

Also for this we probably need the Issue.

As a reference, here is the issue: [https://github.com/elastic/beats/issues/4322](https://github.com/elastic/beats/issues/4322)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2017, 12:41pm UTC](https://discuss.elastic.co/t/nginx-proxies/85757/5 "2017-06-13T12:41:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.