tshark http get x-forwarded-for ip in one line

Try this after capturing and saving the file.

tshark -r <yourpcap> -Tfields -e "http.request.method==GET" -e "http.request.uri" -e "http.x_forwarded_for" -e frame.time_relative

If they're in the same packet, from a live capture (Note: from this example you can add any container that you want to display as a column just by adding more -e's):

tshark -i eth0 -R 'tcp.port==80&&http.request.method=="GET"&&http.x_forwarded_for' -T fields -e frame.time -e http.request.method -e http.request.uri

The other answer will work, except that your initial capture was with a display filter. You can not save a live capture in tshark while using a display filter on it, so the result of the other answer's output would be the lines you want, plus a lot of unwanted empty space for packets which match your unfiltered -r request on the whole trace but don't have the fields you're looking for. Another way to do it would be to save with a capture filter then read it against a display filter but in this case you can do it in one step since you're just looking for the field output on a live capture.