# Grok regex ignore characters in named capture group

**URL:** <https://discuss.elastic.co/t/grok-regex-ignore-characters-in-named-capture-group/57719>\
**Category:** Logstash\
**Created:** [August 10, 2016, 4:02pm UTC](https://discuss.elastic.co/t/grok-regex-ignore-characters-in-named-capture-group/57719 "2016-08-10T16:02:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tyngd\_Punkt](https://avatars.discourse-cdn.com/v4/letter/t/f19dbf/32.png) [@Tyngd\_Punkt](https://discuss.elastic.co/u/Tyngd_Punkt)\
**Post date:** [August 10, 2016, 4:02pm UTC](https://discuss.elastic.co/t/grok-regex-ignore-characters-in-named-capture-group/57719/1 "2016-08-10T16:02:51Z")

</div>

I have a row of data being sent to logstash. The row can contain several IP addresses. However one ip address is always prefixed with IPv4: and i want to only capture this IP address so i have created this Grok regex:

```
match => ["message", "(?<IPv4>IPv4:\s*(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"]

```

which works except for that the new field content looks like this: (it contains IPv4:)  
IPv4: 10.10.10.1

When i want it to only contain the IP:  
10.10.10.1

How can i continue to look for IPv4: to make sure i get the right IP but remove IPv4: from the capture group?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 11, 2016, 6:28am UTC](https://discuss.elastic.co/t/grok-regex-ignore-characters-in-named-capture-group/57719/2 "2016-08-11T06:28:31Z")

</div>

Just put "IPv4:\s\*" outside the capture group.

```
IPv4:\s*(?<IPv4>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

```

Or use the IPV4 grok pattern:

```
IPv4:\s*%{IPV4:IPv4}
```

---

<div class="post-metadata">

**Author:** ![Tyngd\_Punkt](https://avatars.discourse-cdn.com/v4/letter/t/f19dbf/32.png) [@Tyngd\_Punkt](https://discuss.elastic.co/u/Tyngd_Punkt)\
**Post date:** [August 11, 2016, 12:10pm UTC](https://discuss.elastic.co/t/grok-regex-ignore-characters-in-named-capture-group/57719/3 "2016-08-11T12:10:45Z")

</div>

Big thanks, i have learned a lot today

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/grok-regex-ignore-characters-in-named-capture-group/57719/4 "2017-07-06T04:43:50Z")

</div>