Get HTTP Header from Proxied traffic

[damelo]

Greetings,

We've deployed Securityonion to monitor incoming HTTP traffic proxied through Cloudflare. The Src IP is therefore Cloudflare's and the originating IP is found in HTTP headers, such as X-Real-IP and CF-Connecting-IP.

I'm wondering what would be the best approach to get the IP from the Headers and change the Src IP, replacing Cloudflare's with the real originating IP. Using logstash?

Does it make sense? Anyone from the community has faced such scenario?