Currently helpers.formatHttpRequest mainly uses req.socket.remoteAddress for the "client.ip" ECS field. It could consider using some of the HTTP request headers (esp. X-Forwarded-For) to set this. If using Express, then req.ip is used which sometimes will use X-Forwarded-For, depending on user configuration.