Why is field is not extracted properly for Windows event log?

[Nraj87]

Field is not extracted properly for Windows event log  where Ip address mark as "Client IP"

Try to extract Field below Regexs but no luck, in _internal logs Regexs was applied to the prorp.conf Successfully.

Please Suggest if anyone face this issue.

Regex 1

(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

Regex 2
[^+]Client\s+IP\:\s+(?<ip>\d+.\d+.\d+.\d+)\s+

[gcusello]

Hi @Nraj87,

could you share a ample of your logs highlighting the string to associate to IP?

Ciao.

Giuseppe