Last IP from possible comma separated list of IPs

I'm struggling to match the last IP in pattern which may contain a comma separated list of IPs.

e.g. both of these appear in my logs:

  • is my desired match
  • is my desired match

I haven't seen more than 2 IPs in a row yet, but assume that's possible.

I was hoping something like this would work but no luck yet:


Any suggestions? Thank you in advance.

$ will not work because that anchors to end of line, not end of field. However, the \t effectively anchors to end of field, so removing the $ might work.

Thanks for the suggestion.

I believe this works for both single IPs or variable length list of comma separated IPs:



mutate {
  split => ["x_forwarded_for_temp" , ","]
  add_field => ["x_forwarded_for", "%{[x_forwarded_for_temp][-1]}" ]

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.