Nginx: Log client ip behind NAT with http_x_forwarded_for (X-Forwarded-For Header)

nginx -V | grep with-http_realip_module
 
# /etc/nginx/nginx.conf
...
http {
    ...
    # set_real_ip_from 0.0.0.0/0;
    set_real_ip_from x.x.x.x/x; # LB subnet
    real_ip_header X-Forwarded-For;
    ...
}
...

cat /etc/nginx/nginx.conf
...
log_format  main  '$http_x_forwarded_for - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log main;
...

service nginx reload