How to write the regex to extract the IP address and port number from my log files?

[bluesaint]

I have got a field in my log files that is storing failed login IP address "Failed password for invalid user astro from 65.208.122.48 on port 18982". Can anyone suggest how can I extract the IP address and port from text seen in quotations?

[richgalloway]

In search mode you could use rex:

... | rex field=foo "from (?<ipAddress>[^\s]+) on port (?<port>\d+)" | ...