How to capture the last ip address written in my x forwarded for header.

Hi

Assuming that your XFF header has a common delimiter eg comma, then you could use something like this

when HTTP_REQUEST {

    if {HTTP::header exists X-Forwarded-For } {

        Logic assumes that the header is delimited with a comma
        set xff [string trim [lindex [split [HTTP::header values X-Forwarded-For] ,] end]]
        log local0. "XFF Last Entry = $xff"
    }
}