In the below log we have User Agent fallowed by two Ip addresses. So i want to extract below fields
UserAgent , IPAdd2, IPAdd2
My Regex : (getting error)
rex (?.[a-zA-Z0-9-/^%?;.\s\w&()=-]+) | rex "^(?i)(?P[^ ,]+)(,(?P[^ ,]+))?"
"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:32.0) Gecko/20100101 Firefox/28.0" "158.69.213.225, 23.217.200.191"
This will create a mult-valued field:
... | rex max_match=0 "(?<IPAddress>\d+\.\d+\.\d+\.\d+)"
You can use a more specific RegEx if you like, but the more complicated it is, the slower it will be, too, and simpler ones are unlikely to have false positives.