Consider only first IP on apache access log

Elastic Stack Logstash
1

Hello all,
I need an help about a small problem I've:
in my access log I have a list of IPs (the end user, ha proxy, varnish ....) one after the other. in order to filter correctly I wish to retain only client IP.
what should I do to achieve that? I can also add all the IPs in another field (that won't be indexed).
thank you very much
best regards
Nick

2

Capture the first IP address, then match but don't capture zero, one, or more additional IP addresses.

%{IP:ip_address}(, %{IP})*
3

Hi Magnus,
thank you very much, works like a charm.
best regards
Nick

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.