diff --git a/services/httpd/handler_test.go b/services/httpd/handler_test.go
index d99061d639..75022e2e15 100644
--- a/services/httpd/handler_test.go
+++ b/services/httpd/handler_test.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
@@ -593,6 +594,23 @@ func TestHandler_HandleBadRequestBody(t *testing.T) {
 	}
 }
 
+// Ensure X-Forwarded-For header writes the correct log message.
+func TestHandler_XForwardedFor(t *testing.T) {
+	var buf bytes.Buffer
+	h := NewHandler(false)
+	h.CLFLogger = log.New(&buf, "", 0)
+
+	req := MustNewRequest("GET", "/query", nil)
+	req.Header.Set("X-Forwarded-For", "192.168.0.1")
+	req.RemoteAddr = "127.0.0.1"
+	h.ServeHTTP(httptest.NewRecorder(), req)
+
+	parts := strings.Split(buf.String(), " ")
+	if parts[0] != "192.168.0.1,127.0.0.1" {
+		t.Errorf("unexpected host ip address: %s", parts[0])
+	}
+}
+
 type invalidJSON struct{}
 
 func (*invalidJSON) MarshalJSON() ([]byte, error) { return nil, errors.New("marker") }
diff --git a/services/httpd/response_logger.go b/services/httpd/response_logger.go
index bc635fcfe4..7d21dc778e 100644
--- a/services/httpd/response_logger.go
+++ b/services/httpd/response_logger.go
@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/http"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/influxdata/influxdb/influxql"
@@ -84,11 +85,15 @@ func buildLogLine(l *responseLogger, r *http.Request, start time.Time) string {
 	username := parseUsername(r)
 
 	host, _, err := net.SplitHostPort(r.RemoteAddr)
-
 	if err != nil {
 		host = r.RemoteAddr
 	}
 
+	if xff := r.Header["X-Forwarded-For"]; xff != nil {
+		addrs := append(xff, host)
+		host = strings.Join(addrs, ",")
+	}
+
 	uri := r.URL.RequestURI()
 
 	referer := r.Referer()