# X-forwarded-for in audit logs
**URL:** https://discuss.elastic.co/t/x-forwarded-for-in-audit-logs/112531
**Category:** Elasticsearch
**Created:** [December 20, 2017, 12:52am UTC](https://discuss.elastic.co/t/x-forwarded-for-in-audit-logs/112531 "2017-12-20T00:52:26Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@djtecha](https://discuss.elastic.co/u/djtecha)
#### Post date: [December 20, 2017, 12:52am UTC](https://discuss.elastic.co/t/x-forwarded-for-in-audit-logs/112531/1 "2017-12-20T00:52:26Z")
Does anyone have a good method for getting the client IP in the security index when you pass through a load balancer? I'm set up in AWS and I can see tons of anonymous\_access\_denied errors but they have the src address all from the ELB. Now I know there's probably some agent out there that's set up incorrectly, but I have no way to track this down. I'm not even getting a non 200 response in the ELB logs, so it's kind of like throwing darts in the dark.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 17, 2018, 12:52am UTC](https://discuss.elastic.co/t/x-forwarded-for-in-audit-logs/112531/2 "2018-01-17T00:52:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.