xforwardedfor optional
@@ -37,7 +37,7 @@ filter {
# Lines with X-Forwarded-For set. We already filtered out the 'xfordwardedfor:-', so anything left with a large enough log line should be good
# Optionally match multiple Ips in xforwardedfor, eg. xforwardedfor:1.2.3.4, 2.3.4.5 -> the second IP address (or third or Nth) is an intermediate proxy such as zscaler and will be stored in source.ip_otherproxies
grok {
- match => { "messagenosyslog" => [ "frontend:(?<[redir][frontend][name]>([^/]*))/%{IPORHOST:[redir][frontend][ip]}:%{POSINT:[redir][frontend][port]} backend:%{NOTSPACE:[redir][backend][name]} client:%{IPORHOST:[source][cdn][ip]}:%{POSINT:[source][cdn][port]} xforwardedfor:%{IPORHOST:[source][ip]}(?:, )(?:%{GREEDYDATA:[source][ip_otherproxies]}) headers:\{(?<[http][headers][all]>([^\}]*))} statuscode:%{INT:[http][response][status_code]} request:%{GREEDYDATA:[http][request][body][content]}" ] }
+ match => { "messagenosyslog" => [ "frontend:(?<[redir][frontend][name]>([^/]*))/%{IPORHOST:[redir][frontend][ip]}:%{POSINT:[redir][frontend][port]} backend:%{NOTSPACE:[redir][backend][name]} client:%{IPORHOST:[source][cdn][ip]}:%{POSINT:[source][cdn][port]} xforwardedfor:%{IPORHOST:[source][ip]}(?:, )?(?:%{GREEDYDATA:[source][ip_otherproxies]}) headers:\{(?<[http][headers][all]>([^\}]*))} statuscode:%{INT:[http][response][status_code]} request:%{GREEDYDATA:[http][request][body][content]}" ] }
add_tag => [ "redirtrafficxforwardedfor" ]
}
# remove field [source][ip_otherproxies] if empty
