I have got a field in my log files that is storing failed login IP address "Failed password for invalid user astro from 65.208.122.48 on port 18982". Can anyone suggest how can I extract the IP address and port from text seen in quotations?
In search mode you could use rex
:
... | rex field=foo "from (?<ipAddress>[^\s]+) on port (?<port>\d+)" | ...