How do we match multiple random ips?

[magnusbaeck (Magnus Bäck)]

If you're okay with getting all IPs in an array field you can just use grok extract all the IPs to a string and use the mutate filter to split that string.

filter {
  grok {
    match => ["message", "^(?<ip>%{IP}(, %{IP})*) ..."]
  }
  mutate {
    split => ["ip", ", "]
  }
}

It looks like you might always have at least two IPs, each followed by a space, followed by a comma-separated list of IPs. In that you'll have to adjust the filters a bit but it shouldn't be too hard.