fix(helpers): fix setting remote address and port in formatHttpRequest

Co-authored-by: Trent Mick <[email protected]>
Refs: #19
Fixes: #18

Author: SpencerLN

helpers/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @elastic/ecs-helpers Changelog
 
+## Unreleased
+
+- Fix the setting of the remote IP and port
+  [ECS client fields](https://www.elastic.co/guide/en/ecs/current/ecs-client.html):
+  `client.address`, `client.ip`, `client.port`. This also supports using
+  Express's `req.ip`.
+
 ## v0.6.0
 
 - Add `formatError` for adding [ECS Error fields](https://www.elastic.co/guide/en/ecs/current/ecs-error.html)

helpers/lib/http-formatters.js

@@ -22,8 +22,6 @@ function formatHttpRequest (ecs, req) {
     id,
     method,
     url,
-    remoteAddress,
-    remotePort,
     headers,
     hostname,
     httpVersion,
@@ -66,10 +64,21 @@ function formatHttpRequest (ecs, req) {
     }
   }
 
-  if (remoteAddress || remotePort) {
-    ecs.client = ecs.client || {}
-    ecs.client.address = remoteAddress
-    ecs.client.port = remotePort
+  // https://www.elastic.co/guide/en/ecs/current/ecs-client.html
+  ecs.client = ecs.client || {}
+  let ip
+  if (req.ip) {
+    // Express provides req.ip that may handle X-Forward-For processing.
+    // https://expressjs.com/en/5x/api.html#req.ip
+    ip = req.ip
+  } else if (socket && socket.remoteAddress) {
+    ip = socket.remoteAddress
+  }
+  if (ip) {
+    ecs.client.ip = ecs.client.address = ip
+  }
+  if (socket) {
+    ecs.client.port = socket.remotePort
   }
 
   const hasHeaders = Object.keys(headers).length > 0

helpers/lib/serializer.js

@@ -105,6 +105,7 @@ const stringify = build({
       type: 'object',
       properties: {
         address: string,
+        ip: string,
         port: number
       }
     },

helpers/test.js

@@ -175,6 +175,13 @@ test('formatHttpRequest and formatHttpResponse should return a valid ecs object'
         body: { bytes: contentLen }
       }
     })
+    // https://www.elastic.co/guide/en/ecs/current/ecs-client.html fields
+    t.ok(line.client, 'client fields are set')
+    t.ok(line.client.address === '127.0.0.1' || line.client.address === '::ffff:127.0.0.1',
+      'client.address is set')
+    t.ok(line.client.ip === line.client.address,
+      'client.address duplicated to client.ip')
+    t.equal(typeof (line.client.port), 'number')
 
     res.end(resBody)
   }