In case of TCP load balancer, the headers are sent unmodified and backend instances receive the ELB's IP as the client IP. This is described in the AWS docs - http://docs.aws.amazon.com/elasticloadbalancing/latest/class...

I have been running this. It works well. I also wrote some custom code to send the stack-traces, if we get any, to a slack channel.

That sounds fantastic. Do you have an example of how you extracted the trace? Was it simple to extend ElastAlert or did you have to fork it to add that kind of option?

The trace is basically extracted using Logstash's multiline filter. It adds a tag "stacktrace" to the log entry.

I just made a few changes in SlackAlerter class to customize for my use-case. I'd try to clean-up and send a PR soon.