Field Extraction Stops Working

[corwinz6]

I want to associate the IP address included in the logs that refers to the device the log came from to a field. i.e:

Nov 12 16:04:21 x.x.x.x date=2012-11-12 time=16:03:21

where x.x.x.x is the IP I want included in the new field. When I use the interactive field extractor sometimes it gives me:

(?i)^(?:[^ ]* ){3}(?P<FIELDNAME>[^ ]+)

which works for a week or two and then stops.

If I use the extractor again it then gives me a slightly different output of:

(?i)^(?:[^ ]* ){4}(?P<FIELDNAME>[^ ]+)

This one then works for a time and I have to end up changing it back to the {3} extraction and so on. I'm not very regex savvy, is there someone who could assist me with a regex string that will consistently grab that field?

Thanks

[martin_mueller · Accepted solution]

The field extractor regex basically counts the number of spaces before the IP. During the first nine days of the month there is an extra space, compare:

Nov  9 01:02:03 x.x.x.x
Nov 10 01:02:03 x.x.x.x

However, what you want is "three words before the IP", not "three (or four) spaces before the IP". Try something like this untested extraction:

^(?:[^\s]+\s+){3}(?P<FIELDNAME>(\d{1,3}\.){3}\d{1,3})

This looks for "positive number of non-spaces followed by positive number of spaces" (read: "words") three times, then picks out the IP while taking the decimal notation into account. Note, this would allow invalid IPs such as "999.999.999.999".