Help with grok filter for [::ffff:127.0.0.1] hybrid + port

Elastic Stack Beats
1

Hi there,

I need some help to filter (Grok) the following, f.e.: [::ffff:88.88.88.88]:4262,...

this is a log snippet where I need to filter out the IP and port from the following formats...

"New request 366c89e6-9c94-4641-9261-af4c46c18b11 from [::ffff:88.88.88.88]:41496"

Any help is welcome, THX

Br: SedonD

2

May be???:

%{GREEDYDATA:message} *%{IP:src_ip}]:%{INT:src_port}

3

gotcha :slight_smile:

%{GREEDYDATA:message} \[::ffff:%{IPV4:src_ip}]:%{INT:src_port}