How to parse more similar fields with Logstash?

[eperry (Ed)]

This is always a tough issue to deal with. Grok while incredibly powerful occasionally has limits. I have never found a good answer to deal with this. But there are options.

Here is an old article for one way to do it

How do we match multiple random ips?

If you're okay with getting all IPs in an array field you can just use grok extract all the IPs to a string and use the mutate filter to split that string. filter { grok { match => ["message", "^(?<ip>%{IP}(, %{IP})*) ..."] } mutate { split => ["ip", ", "] } } It looks like you might always have at least two IPs, each followed by a space, followed by a comma-separated list of IPs. In that you'll have to adjust the filters a bit but it shouldn't be too hard.

another would be to do it in the ruby filter

Ruby filter plugin | Logstash Reference [8.11] | Elastic

A final option might be to use the KV filter as all your data is in "source=file"

Kv filter plugin | Logstash Reference [8.11] | Elastic