Can an nginx conf file replace an http header when writing to access.log?

Question

I use Cloudflare for my domains.

I've noticed a situation in my access.log file that when someone attempts to connect directly (via the IP address) the $http_x_forwarded_for value is "-", which is correct and by design as $http_x_forwarded_for isn't being set by Cloudflare.

I want to do the following (see first if block), but nginx won't allow it in the main nginx.conf file. Is there another way to do this?

  if ($http_x_forwarded_for = '-') {
    $http_x_forwarded_for = $remote_addr;
  }

  # format: e.g., $http_cf_ipcountry derives from the Cloudflare header HTTP_CF_IPCOUNTRY;
  # the others too follow this format
  log_format complete '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      '"$http_referer" "$http_user_agent" "$host" '
                      '"$http_x_forwarded_for" "$http_cf_ipcountry" "$http_accept_language"';

Timo Stark · Accepted Answer · 2020-03-19 09:03:49Z

1

Using maps instead of if / else :)

Add this to your http context block:

log_format complete '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      '"$http_referer" "$http_user_agent" "$host" '
                      '"$logforwarded" "$http_cf_ipcountry" "$http_accept_language"';


map $http_x_forwarded_for $logforwarded {
     default $http_x_forwarded_for;
     ''  $remote_addr;
 }

The access-log entry will look like this: ::1 - - [02/Mar/2020:05:51:46 -0500] "GET / HTTP/1.1" 200 4 "-" "curl/7.29.0" "localhost" "::1" "-" "-"

answered Mar 19, 2020 at 9:03

Timo Stark

3,1011 gold badge15 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Code Prowler Over a year ago

Thank you Timo, great example!

Collectives™ on Stack Overflow

Can an nginx conf file replace an http header when writing to access.log?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related