Help with grok filter for [::ffff:] hybrid + port

Hi there,

I need some help to filter (Grok) the following, f.e.: [::ffff:]:4262,...

this is a log snippet where I need to filter out the IP and port from the following formats...

"New request 366c89e6-9c94-4641-9261-af4c46c18b11 from [::ffff:]:41496"

Any help is welcome, THX

Br: SedonD

May be???:

%{GREEDYDATA:message} *%{IP:src_ip}]:%{INT:src_port}

gotcha :slight_smile:

%{GREEDYDATA:message} \[::ffff:%{IPV4:src_ip}]:%{INT:src_port}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.