I want to associate the IP address included in the logs that refers to the device the log came from to a field. i.e:
Nov 12 16:04:21 x.x.x.x date=2012-11-12 time=16:03:21
where x.x.x.x is the IP I want included in the new field. When I use the interactive field extractor sometimes it gives me:
(?i)^(?:[^ ]* ){3}(?P<FIELDNAME>[^ ]+)
which works for a week or two and then stops.
If I use the extractor again it then gives me a slightly different output of:
(?i)^(?:[^ ]* ){4}(?P<FIELDNAME>[^ ]+)
This one then works for a time and I have to end up changing it back to the {3} extraction and so on. I'm not very regex savvy, is there someone who could assist me with a regex string that will consistently grab that field?
Thanks
The field extractor regex basically counts the number of spaces before the IP. During the first nine days of the month there is an extra space, compare:
Nov 9 01:02:03 x.x.x.x
Nov 10 01:02:03 x.x.x.x
However, what you want is "three words before the IP", not "three (or four) spaces before the IP". Try something like this untested extraction:
^(?:[^\s]+\s+){3}(?P<FIELDNAME>(\d{1,3}\.){3}\d{1,3})
This looks for "positive number of non-spaces followed by positive number of spaces" (read: "words") three times, then picks out the IP while taking the decimal notation into account. Note, this would allow invalid IPs such as "999.999.999.999".
The field extractor regex basically counts the number of spaces before the IP. During the first nine days of the month there is an extra space, compare:
Nov 9 01:02:03 x.x.x.x
Nov 10 01:02:03 x.x.x.x
However, what you want is "three words before the IP", not "three (or four) spaces before the IP". Try something like this untested extraction:
^(?:[^\s]+\s+){3}(?P<FIELDNAME>(\d{1,3}\.){3}\d{1,3})
This looks for "positive number of non-spaces followed by positive number of spaces" (read: "words") three times, then picks out the IP while taking the decimal notation into account. Note, this would allow invalid IPs such as "999.999.999.999".