Extract part of a log using regex in KQL

Elastic Stack Kibana
1

I've log messages that looks like this

07:17:58.211 [Thread.3;] INFO  Dispatcher - Message from XXX.XXX.XXX.XXX/PORT not dispatched, reason: blah blah, status=xyz

I'm trying to query then visualize the different IP address (XXX.XXX.XXX.XXX) by their count. I tried the following query in KSQL message: /[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ but I'm getting this error

KQLSyntaxError: Expected AND, OR, end of input, whitespace but "{" found.
message: /[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/
---------------^
    at Rt (https://kibana/46336/bundles/plugin/data/kibana/data.plugin.js:1:44634)
    at https://kibana/46336/bundles/plugin/data/kibana/data.plugin.js:1:45216
    at Array.map (<anonymous>)
    at Ct (https://kibana/46336/bundles/plugin/data/kibana/data.plugin.js:1:45192)
    at Ht (https://kibana/46336/bundles/plugin/data/kibana/data.plugin.js:1:47464)
    at search_source_SearchSource.flatten (https://kibana/46336/bundles/plugin/data/kibana/data.plugin.js:1:70012)
    at t.project (https://kibana/46336/bundles/plugin/data/kibana/data.plugin.js:1:62640)
    at t._next (https://kibana/46336/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:370:282405)
    at t.next (https://kibana/46336/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:21:15937)
    at https://kibana/46336/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:423:1265833

What is the proper way of querying with regex?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.