Skip to content

[Apache Tomcat] Fix pipelines to correctly split the X-Forwarded-For comma delineated IPs #15873

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 6, 2025
Merged

[Apache Tomcat] Fix pipelines to correctly split the X-Forwarded-For comma delineated IPs #15873

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a09bd16
fix
Linu-Elias Nov 5, 2025
d0e7324
Merge branch 'main' into apache-regex-fix
Linu-Elias Nov 5, 2025
c2ba260
Update changelog.yml
Linu-Elias Nov 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/apache_tomcat/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.12.1"
changes:
- description: Fix IP seperator regex for access logs
type: bugfix
link: https://github.com/elastic/integrations/pull/15873
- version: "1.12.0"
changes:
- description: Improve documentation
Expand Down
3 changes: 2 additions & 1 deletion packages/apache_tomcat/data_stream/access/_dev/test/pipeline/test-access.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,5 @@
81.2.69.144 - admin [02/Mar/2023:18:58:17 +0530] "POST /host-manager/images/asf-logo.svg HTTP/1.1" 200 20486 ms:54321 X 400 "http://localhost:8080/host-manager/html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" X-Forwarded-For="127.0.0.1"
81.2.69.144 - admin [02/Mar/2023:18:58:17 +0530] "POST /host-manager/images/asf-logo.svg HTTP/1.1" 200 20486 ms:3214 81.2.69.145 40 "http://localhost:8080/host-manager/html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" X-Forwarded-For="127.0.0.1, 127.0.0.3"
81.2.69.144 - admin [02/Mar/2023:18:58:17 +0530] "POST /host-manager/images/asf-logo.svg HTTP/1.1" 200 20486 ms:98765 50 "http://localhost:8080/host-manager/html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" X-Forwarded-For=""
10.10.10.10 - - [28/May/2024:17:20:05 +0200] "GET / " 200 17 ms:1234
10.10.10.10 - - [28/May/2024:17:20:05 +0200] "GET / " 200 17 ms:1234
81.2.69.144 - admin [02/Mar/2023:18:58:17 +0530] "POST /host-manager/images/asf-logo.svg HTTP/1.1" 200 20486 ms:3214 81.2.69.145 40 "http://localhost:8080/host-manager/html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" X-Forwarded-For="127.0.0.1,127.0.0.3, 127.0.0.4"
86 changes: 85 additions & 1 deletion packages/apache_tomcat/data_stream/access/_dev/test/pipeline/test-access.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1090,6 +1090,90 @@
"tags": [
"preserve_original_event"
]
},
{
"@timestamp": "2023-03-02T13:28:17.000Z",
"apache_tomcat": {
"access": {
"http": {
"ident": "-",
"useragent": "admin"
},
"ip": {
"local": "81.2.69.145"
},
"request_process_time": 3214.0,
"response_time": 40.0
}
},
"client": {
"ip": [
"127.0.0.1",
"127.0.0.3",
"127.0.0.4"
]
},
"destination": {
"bytes": 20486
},
"ecs": {
"version": "8.11.0"
},
"event": {
"category": [
"web"
],
"kind": "event",
"module": "apache_tomcat",
"original": "81.2.69.144 - admin [02/Mar/2023:18:58:17 +0530] \"POST /host-manager/images/asf-logo.svg HTTP/1.1\" 200 20486 ms:3214 81.2.69.145 40 \"http://localhost:8080/host-manager/html\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\" X-Forwarded-For=\"127.0.0.1,127.0.0.3, 127.0.0.4\"",
"outcome": "success",
"type": [
"access"
]
},
"http": {
"request": {
"method": "POST",
"referrer": "http://localhost:8080/host-manager/html"
},
"response": {
"status_code": 200
},
"version": "1.1"
},
"related": {
"ip": [
"81.2.69.144",
"81.2.69.145",
"127.0.0.1",
"127.0.0.3",
"127.0.0.4"
]
},
"source": {
"ip": "81.2.69.144"
},
"tags": [
"preserve_original_event"
],
"url": {
"extension": "svg",
"original": "/host-manager/images/asf-logo.svg",
"path": "/host-manager/images/asf-logo.svg"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Chrome",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36",
"os": {
"full": "Windows 10",
"name": "Windows",
"version": "10"
},
"version": "109.0.0.0"
}
}
]
}
}
2 changes: 1 addition & 1 deletion packages/apache_tomcat/data_stream/access/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,7 @@ processors:
if: ctx._tmp?.header_forwarder != null && ctx._tmp.header_forwarder != '' && ctx._tmp.header_forwarder != '-'
tag: 'split_x_forwarded_for'
target_field: client.ip
separator: ', '
separator: ',\s?'
- foreach:
field: client.ip
if: ctx.client?.ip instanceof List
Expand Down
2 changes: 1 addition & 1 deletion packages/apache_tomcat/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: "3.0.2"
name: apache_tomcat
title: Apache Tomcat
version: "1.12.0"
version: "1.12.1"
description: Collect and parse logs and metrics from Apache Tomcat servers with Elastic Agent.
categories:
- web
Expand Down