From 32483a7f2617742efc466bae3f03fb6afbf0190a Mon Sep 17 00:00:00 2001
From: Konstantin Grachev <me@grachevko.ru>
Date: Sun, 25 Nov 2018 16:24:28 +0300
Subject: [PATCH] [Bugfix] Nginx Parser: http_x_forwarded_for can contain
 multiple IP divided by comma

Signed-off-by: Konstantin Grachev <me@grachevko.ru>
---
 lib/fluent/plugin/parser_nginx.rb |  2 +-
 test/plugin/test_parser_nginx.rb  | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/lib/fluent/plugin/parser_nginx.rb b/lib/fluent/plugin/parser_nginx.rb
index 9717e1bcbe..e9090ef06d 100644
--- a/lib/fluent/plugin/parser_nginx.rb
+++ b/lib/fluent/plugin/parser_nginx.rb
@@ -21,7 +21,7 @@ module Plugin
     class NginxParser < RegexpParser
       Plugin.register_parser("nginx", self)
 
-      config_set_default :expression, /^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)"(?:\s+(?<http_x_forwarded_for>[^ ]+))?)?$/
+      config_set_default :expression, /^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)"(?:\s+\"?(?<http_x_forwarded_for>[^\"]*)\"?)?)?$/
       config_set_default :time_format, "%d/%b/%Y:%H:%M:%S %z"
     end
   end
diff --git a/test/plugin/test_parser_nginx.rb b/test/plugin/test_parser_nginx.rb
index fc06485da4..7a6c3cd8eb 100644
--- a/test/plugin/test_parser_nginx.rb
+++ b/test/plugin/test_parser_nginx.rb
@@ -28,6 +28,18 @@ def setup
       'agent'                => 'Opera/12.0',
       'http_x_forwarded_for' => '-'
     }
+    @expected_extended_multiple_ip = {
+      'remote'               => '127.0.0.1',
+      'host'                 => '192.168.0.1',
+      'user'                 => '-',
+      'method'               => 'GET',
+      'path'                 => '/',
+      'code'                 => '200',
+      'size'                 => '777',
+      'referer'              => '-',
+      'agent'                => 'Opera/12.0',
+      'http_x_forwarded_for' => '127.0.0.1, 192.168.0.1'
+    }
   end
 
   def create_driver
@@ -65,4 +77,12 @@ def test_parse_with_http_x_forwarded_for
       assert_equal(@expected_extended, record)
     }
   end
+
+  def test_parse_with_http_x_forwarded_for_multiple_ip
+    d = create_driver
+    d.instance.parse('127.0.0.1 192.168.0.1 - [28/Feb/2013:12:00:00 +0900] "GET / HTTP/1.1" 200 777 "-" "Opera/12.0" "127.0.0.1, 192.168.0.1"') { |time, record|
+      assert_equal(event_time('28/Feb/2013:12:00:00 +0900', format: '%d/%b/%Y:%H:%M:%S %z'), time)
+      assert_equal(@expected_extended_multiple_ip, record)
+    }
+  end
 end