Forum Discussion
iaine
Apr 11, 2018Nacreous
Hi
Assuming that your XFF header has a common delimiter eg comma, then you could use something like this
when HTTP_REQUEST {
if {HTTP::header exists X-Forwarded-For } {
Logic assumes that the header is delimited with a comma
set xff [string trim [lindex [split [HTTP::header values X-Forwarded-For] ,] end]]
log local0. "XFF Last Entry = $xff"
}
}