Grok regex ignore characters in named capture group

I have a row of data being sent to logstash. The row can contain several IP addresses. However one ip address is always prefixed with IPv4: and i want to only capture this IP address so i have created this Grok regex:

match => ["message", "(?<IPv4>IPv4:\s*(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"]

which works except for that the new field content looks like this: (it contains IPv4:)

When i want it to only contain the IP:

How can i continue to look for IPv4: to make sure i get the right IP but remove IPv4: from the capture group?

1 Like

Just put "IPv4:\s*" outside the capture group.


Or use the IPV4 grok pattern:

1 Like

Big thanks, i have learned a lot today