Can you help me build a regex that extracts an IP Address from a log message?

[gokikrishnan198]

How do I extract an IP address from a log message using regex? All the four octets need to be pulled at a time,

rex field=LogMsg "Ip Address :(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Not sure, \d{1,3}, why 1 is being used here. But the above query did not work.

[ashwinm]

The d{1,3} is used to denote that there might be min of 1 digit and max of 3 digits , when it comes to IP's we know the range can be from 0 to 255. So best practise is to use " d{1,3}.\d{1,3}.\d{1,3}.\d{1,3} ". In your case error might be with the fieldname.,

[FrankVl · Accepted solution]

The \d{1,3} means at least one digit, at most 3 digits. Which is sensible for IP octets. I don't see an obvious reason why the regex would't work. At least the part capturing the IP address looks OK to me (assuming you had something like <ip> after the ?. See also: https://regex101.com/r/U5bog1/1

Are you sure the field name specified is ok? Are you sure the "Ip Address :" part is OK? Perhaps share some sample data.

PS: a . matches anything in a regex. So also a literal .. A safer regex would be: (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) which only matches digits separated by literal . characters.

[gokikrishnan198]

Thanks. It was perfect.