Hi,
How can i get ip address from like under log??
---
Sep 13 23:55:42 mailhost1 postfix/smtpd[15824]: [ID 197553 mail.info] connect from example.com[1.1.1.1]
---
I use search command "host=mailhost1 | top limit=100 client ",
and result is "example.com[1.1.1.1]".(source type is postfix_syslog)
I need only ip address to use geoip.
thanks
Hi saito0910,
try something like this:
host=mailhost1 | rex field=client "(?<myIP>(\d+\.){3}\d+)]$" | top limit=100 myIP
this will get the IP form the client field and returns it as new field myIP
hope this helps ...
cheers, MuS
Hi saito0910,
try something like this:
host=mailhost1 | rex field=client "(?<myIP>(\d+\.){3}\d+)]$" | top limit=100 myIP
this will get the IP form the client field and returns it as new field myIP
hope this helps ...
cheers, MuS
Thanks MuS! That worked well! 🙂