diff --git a/querylog/querylog_file.go b/querylog/querylog_file.go
index e0540f43..02296a98 100644
--- a/querylog/querylog_file.go
+++ b/querylog/querylog_file.go
@@ -561,7 +561,9 @@ func decode(ent *logEntry, str string) {
 		}
 		switch k {
 		case "IP":
-			ent.IP = v
+			if len(ent.IP) == 0 {
+				ent.IP = v
+			}
 		case "T":
 			ent.Time, err = time.Parse(time.RFC3339, v)