Add visitor IPs from your other tools

GA4 doesn’t keep IP addresses. These tools often do, and most also hold the landing URL and timestamp, so they work without GA4 too.

What to pull

Keep only requests whose URL carries an fbclid, from 1 Jan 2025 to today. Keep 3 fields and drop everything else:

Timestamp: when the request happened, in UTC where the tool allows it.
IP: the visitor’s address, not a proxy’s or a CDN’s.
URL: the full landing URL with its query string, so the fbclid survives.

Not comfortable filtering? Give us read-only access to the raw export and we filter it on our side. See how to send it.

Analytics tools

Amplitude

Check first: no data retention limit (TTL) was set, and the site’s SDK doesn’t set trackingOptions.ipAddress to false.Fastest route: turn on the Amazon S3 export with a backfill starting 1 Jan 2025, then give us access to the bucket.Or export it yourself with the project’s API key and secret key, in windows of up to 365 days. Split by month if a window passes the 4 GB cap. EU projects use analytics.eu.amplitude.com.

curl -u "$API_KEY:$SECRET_KEY" -o 2025.zip \
  "https://amplitude.com/api/2/export?start=20250101T00&end=20251231T23"
unzip -p 2025.zip | zcat | jq -c 'select(tostring | test("fbclid")) | {ts: .event_time, ip: .ip_address, url: (.event_properties["[Amplitude] Page Location"] // .event_properties["[Amplitude] Page URL"])}'

Export windows follow upload time, not event time, so pad each window by a day.

PostHog

Check first: in Settings > Project > IP data capture configuration, “Discard client IP data” must be off. EU-hosted organizations default to discarding.Export: Data pipelines > batch export to S3, BigQuery or Snowflake, with a backfill starting 1 Jan 2025. Keep timestamp, $ip and $current_url on $pageview events. Then give us access to the destination.To check what you have first, run this in the SQL editor:

SELECT toStartOfMonth(timestamp) AS month,
       count() AS fbclid_hits,
       countIf(properties.$ip IS NOT NULL) AS with_ip
FROM events
WHERE event = '$pageview'
  AND properties.$current_url LIKE '%fbclid=%'
  AND timestamp >= '2025-01-01'
GROUP BY month
ORDER BY month

Other tools

Adobe Analytics

Check first: in Admin > Report Suites > Edit Settings > General > General Account Settings, IP obfuscation must be off.Export: Admin > Data Feeds > Add. Report suite: production. Interval: daily. Start date: 1 Jan 2025. End date: today. Destination: your S3, Google Cloud or Azure bucket. Columns, in this order: ip, hit_time_gmt, page_url. Then give us access to the bucket, or filter the files:

for f in *.tar.gz; do tar -xzOf "$f" hit_data.tsv; done | awk -F'\t' '$3 ~ /fbclid=/'

Adobe caps URLs at 255 bytes, so long URLs can lose the fbclid. If you also store it in an eVar or the tracking code, add that column.

Heap

Exporting with IPs needs Heap Connect. Give us access to the warehouse it syncs to, or run:

SELECT time, ip, domain, path, query
FROM pageviews
WHERE query LIKE '%fbclid=%'
  AND time >= '2025-01-01'

Segment

Works if Segment loads a warehouse or S3 bucket (Connections > Destinations). Give us access to the pages table, or run:

SELECT timestamp, context_ip, url
FROM your_source_schema.pages
WHERE url LIKE '%fbclid=%'
  AND timestamp >= '2025-01-01'

Server-side Google Tag Manager

The container stores nothing itself. Look for a tag writing events to BigQuery (such as Stape’s Write to BigQuery or Logger tag), or Cloud Run request logs routed to BigQuery by a log sink.

Cloud Run logs in BigQuery

SELECT timestamp,
       httpRequest.remoteIp AS ip,
       httpRequest.requestUrl AS hit_url
FROM `your-project.your_dataset.run_googleapis_com_requests`
WHERE httpRequest.requestUrl LIKE '%fbclid%'
  AND timestamp >= '2025-01-01'

The page URL sits URL-encoded in the dl parameter of hit_url. Give us access to the dataset.

Matomo

Check first: Administration > Privacy > Anonymize data must be off. A masked IP ends in .0.0.Export: one day per call, looping from 2025-01-01 to today. Self-hosted Matomo can also be queried in its database.

curl -s "https://YOUR_MATOMO_HOST/index.php" \
  -d module=API -d method=Live.getLastVisitsDetails \
  -d idSite=1 -d period=day -d date=2025-01-01 \
  -d format=JSON -d filter_limit=-1 -d token_auth=YOUR_TOKEN \
  | jq -c '.[] | .visitIp as $ip | .actionDetails[] | select((.url // "") | test("fbclid=")) | {ts: .timestamp, ip: $ip, url: .url}'

AWS CloudFront

CloudFront console > your distribution > Logging shows the log bucket. Add our AWS account to the bucket policy, or filter the logs:

aws s3 sync s3://YOUR_BUCKET/YOUR_PREFIX/ ./cf-logs/
zcat cf-logs/*.gz | awk -F'\t' '$12 ~ /fbclid=/ {print $1"T"$2"Z\t"$5"\thttps://"$16$8"?"$12}'

Use x-host-header, not cs(Host), which is the CloudFront domain.

Akamai

Use your DataStream 2 stream. It must include cliIP and queryStr, or the fbclid is missing. Give us access to the stream’s bucket, or filter JSON-format files:

zcat *.gz | jq -c 'select((.queryStr // "") | test("fbclid=")) | {ts: .reqTimeSec, ip: .cliIP, url: ("https://" + .reqHost + .reqPath + "?" + .queryStr)}'

Fastly

Use your logging endpoint (your service > Logging). Its format needs the client IP, a timestamp and the full URL: req.url.path alone drops the fbclid. Give us access to the endpoint’s bucket or BigQuery table.

Cloudflare

Use your Logpush job (Enterprise plans). It must include ClientIP, EdgeStartTimestamp and ClientRequestURI. Give us access to the destination, or filter the files:

zcat *.gz | jq -c 'select((.ClientRequestURI // "") | test("fbclid=")) | {ts: .EdgeStartTimestamp, ip: .ClientIP, url: ("https://" + .ClientRequestHost + .ClientRequestURI)}'

Your own server or cPanel

In cPanel: Metrics > Raw Access > Archived Raw Logs. On your own server, look in /var/log/nginx/, /var/log/apache2/ or /var/log/httpd/.

zcat -f access.log* | grep 'fbclid=' | awk '{print $4" "$5"\t"$1"\t"$7}'

Behind a CDN, check the server logs the visitor’s IP, not the CDN’s (Apache mod_remoteip, Nginx real_ip).

​What to pull

​Analytics tools

​Other tools

What to pull

Analytics tools

Other tools