Match all Random IP Addresses


(Curtis Vermeulen) #1

Sorry if this a total rookie question but..
Scenario: I have random multiline log messages that have anywhere from 1 to 100 IP addresses in them. The IP's are sporadic and don't always follow a single pattern. Ie. They don't always follow a single comma, etc.

Goal: Match all IP's and output them to a single field as an array.

Question: Using a grok filter I can match the first result but it then stops processing. Is there an easy way to match each IP without having 100 match statements and 100 fields?

Thoughts: loop the single match statements? Output the original message to a new field and then use mutate to remove anything that doesn't match an IP.

Any insight is appreciated.

Thanks!

(Apologies for bad formating, I'm writing this from my mobile)


(Christian Dahlqvist) #2

Does this open issue match what you are looking for?


(Curtis Vermeulen) #3

It reads like it. Thanks!


(Christian Dahlqvist) #4

Unfortunately that means it is currently not possible, so you may need to use a ruby filter.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.