Match all Random IP Addresses

Elastic Stack Logstash
1

Sorry if this a total rookie question but..
Scenario: I have random multiline log messages that have anywhere from 1 to 100 IP addresses in them. The IP's are sporadic and don't always follow a single pattern. Ie. They don't always follow a single comma, etc.

Goal: Match all IP's and output them to a single field as an array.

Question: Using a grok filter I can match the first result but it then stops processing. Is there an easy way to match each IP without having 100 match statements and 100 fields?

Thoughts: loop the single match statements? Output the original message to a new field and then use mutate to remove anything that doesn't match an IP.

Any insight is appreciated.

Thanks!

(Apologies for bad formating, I'm writing this from my mobile)

2

Does this open issue match what you are looking for?

3

It reads like it. Thanks!

4

Unfortunately that means it is currently not possible, so you may need to use a ruby filter.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.