> ## Documentation Index
> Fetch the complete documentation index at: https://help.dash.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# Add visitor IPs from your other tools

> Export Meta ad clicks with visitor IPs from Amplitude, PostHog, Adobe Analytics, Heap, Segment, server-side GTM, Matomo, your CDN or server logs.

GA4 doesn't keep IP addresses. These tools often do, and most also hold the landing URL and timestamp, so they work without GA4 too.

***

## What to pull

Keep only requests whose URL carries an `fbclid`, from **1 Jan 2025** to today. Keep 3 fields and drop everything else:

* **Timestamp:** when the request happened, in UTC where the tool allows it.
* **IP:** the visitor's address, not a proxy's or a CDN's.
* **URL:** the full landing URL with its query string, so the `fbclid` survives.

Not comfortable filtering? Give us read-only access to the raw export and we filter it on our side. See [how to send it](https://help.dash.fi/integrations/ad-pay-protection/share-click-history.md#how-to-send-it).

***

## Analytics tools

> **Amplitude**
>
> **Check first:** no data retention limit (TTL) was set, and the site's SDK doesn't set `trackingOptions.ipAddress` to `false`.
>
> **Fastest route:** turn on the Amazon S3 export with a backfill starting 1 Jan 2025, then give us access to the bucket.
>
> **Or export it yourself** with the project's API key and secret key, in windows of up to 365 days. Split by month if a window passes the 4 GB cap. EU projects use `analytics.eu.amplitude.com`.
>
> ```bash theme={null}
> curl -u "$API_KEY:$SECRET_KEY" -o 2025.zip \
>   "https://amplitude.com/api/2/export?start=20250101T00&end=20251231T23"
> unzip -p 2025.zip | zcat | jq -c 'select(tostring | test("fbclid")) | {ts: .event_time, ip: .ip_address, url: (.event_properties["[Amplitude] Page Location"] // .event_properties["[Amplitude] Page URL"])}'
> ```
>
> Export windows follow upload time, not event time, so pad each window by a day.

> **PostHog**
>
> **Check first:** in **Settings > Project > IP data capture configuration**, "Discard client IP data" must be off. EU-hosted organizations default to discarding.
>
> **Export:** **Data pipelines** > batch export to S3, BigQuery or Snowflake, with a backfill starting 1 Jan 2025. Keep `timestamp`, `$ip` and `$current_url` on `$pageview` events. Then give us access to the destination.
>
> To check what you have first, run this in the SQL editor:
>
> ```sql theme={null}
> SELECT toStartOfMonth(timestamp) AS month,
>        count() AS fbclid_hits,
>        countIf(properties.$ip IS NOT NULL) AS with_ip
> FROM events
> WHERE event = '$pageview'
>   AND properties.$current_url LIKE '%fbclid=%'
>   AND timestamp >= '2025-01-01'
> GROUP BY month
> ORDER BY month
> ```

***

## Other tools

> **Adobe Analytics**
>
> **Check first:** in **Admin > Report Suites > Edit Settings > General > General Account Settings**, IP obfuscation must be off.
>
> **Export:** **Admin > Data Feeds > Add**. Report suite: production. Interval: daily. Start date: 1 Jan 2025. End date: today. Destination: your S3, Google Cloud or Azure bucket. Columns, in this order: `ip`, `hit_time_gmt`, `page_url`. Then give us access to the bucket, or filter the files:
>
> ```bash theme={null}
> for f in *.tar.gz; do tar -xzOf "$f" hit_data.tsv; done | awk -F'\t' '$3 ~ /fbclid=/'
> ```
>
> Adobe caps URLs at 255 bytes, so long URLs can lose the `fbclid`. If you also store it in an eVar or the tracking code, add that column.

> **Heap**
>
> Exporting with IPs needs Heap Connect. Give us access to the warehouse it syncs to, or run:
>
> ```sql theme={null}
> SELECT time, ip, domain, path, query
> FROM pageviews
> WHERE query LIKE '%fbclid=%'
>   AND time >= '2025-01-01'
> ```

> **Segment**
>
> Works if Segment loads a warehouse or S3 bucket (**Connections > Destinations**). Give us access to the `pages` table, or run:
>
> ```sql theme={null}
> SELECT timestamp, context_ip, url
> FROM your_source_schema.pages
> WHERE url LIKE '%fbclid=%'
>   AND timestamp >= '2025-01-01'
> ```

> **Server-side Google Tag Manager**
>
> The container stores nothing itself. Look for a tag writing events to BigQuery (such as Stape's Write to BigQuery or Logger tag), or Cloud Run request logs routed to BigQuery by a log sink.
>
> ```sql Cloud Run logs in BigQuery theme={null}
> SELECT timestamp,
>        httpRequest.remoteIp AS ip,
>        httpRequest.requestUrl AS hit_url
> FROM `your-project.your_dataset.run_googleapis_com_requests`
> WHERE httpRequest.requestUrl LIKE '%fbclid%'
>   AND timestamp >= '2025-01-01'
> ```
>
> The page URL sits URL-encoded in the `dl` parameter of `hit_url`. Give us access to the dataset.

> **Matomo**
>
> **Check first:** **Administration > Privacy > Anonymize data** must be off. A masked IP ends in `.0.0`.
>
> **Export:** one day per call, looping from 2025-01-01 to today. Self-hosted Matomo can also be queried in its database.
>
> ```bash theme={null}
> curl -s "https://YOUR_MATOMO_HOST/index.php" \
>   -d module=API -d method=Live.getLastVisitsDetails \
>   -d idSite=1 -d period=day -d date=2025-01-01 \
>   -d format=JSON -d filter_limit=-1 -d token_auth=YOUR_TOKEN \
>   | jq -c '.[] | .visitIp as $ip | .actionDetails[] | select((.url // "") | test("fbclid=")) | {ts: .timestamp, ip: $ip, url: .url}'
> ```

> **AWS CloudFront**
>
> **CloudFront console > your distribution > Logging** shows the log bucket. Add our AWS account to the bucket policy, or filter the logs:
>
> ```bash theme={null}
> aws s3 sync s3://YOUR_BUCKET/YOUR_PREFIX/ ./cf-logs/
> zcat cf-logs/*.gz | awk -F'\t' '$12 ~ /fbclid=/ {print $1"T"$2"Z\t"$5"\thttps://"$16$8"?"$12}'
> ```
>
> Use `x-host-header`, not `cs(Host)`, which is the CloudFront domain.

> **Akamai**
>
> Use your DataStream 2 stream. It must include `cliIP` and `queryStr`, or the `fbclid` is missing. Give us access to the stream's bucket, or filter JSON-format files:
>
> ```bash theme={null}
> zcat *.gz | jq -c 'select((.queryStr // "") | test("fbclid=")) | {ts: .reqTimeSec, ip: .cliIP, url: ("https://" + .reqHost + .reqPath + "?" + .queryStr)}'
> ```

> **Fastly**
>
> Use your logging endpoint (**your service > Logging**). Its format needs the client IP, a timestamp and the full URL: `req.url.path` alone drops the `fbclid`. Give us access to the endpoint's bucket or BigQuery table.

> **Cloudflare**
>
> Use your Logpush job (Enterprise plans). It must include `ClientIP`, `EdgeStartTimestamp` and `ClientRequestURI`. Give us access to the destination, or filter the files:
>
> ```bash theme={null}
> zcat *.gz | jq -c 'select((.ClientRequestURI // "") | test("fbclid=")) | {ts: .EdgeStartTimestamp, ip: .ClientIP, url: ("https://" + .ClientRequestHost + .ClientRequestURI)}'
> ```

> **Your own server or cPanel**
>
> In cPanel: **Metrics > Raw Access > Archived Raw Logs**. On your own server, look in `/var/log/nginx/`, `/var/log/apache2/` or `/var/log/httpd/`.
>
> ```bash theme={null}
> zcat -f access.log* | grep 'fbclid=' | awk '{print $4" "$5"\t"$1"\t"$7}'
> ```
>
> Behind a CDN, check the server logs the visitor's IP, not the CDN's (Apache `mod_remoteip`, Nginx `real_ip`).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.