# Best way to extract IPv4 addresses in a pipeline?

**URL:** <https://community.graylog.org/t/best-way-to-extract-ipv4-addresses-in-a-pipeline/5234>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, dump-messagespl\
**Created:** [May 15, 2018, 12:12am UTC](https://community.graylog.org/t/best-way-to-extract-ipv4-addresses-in-a-pipeline/5234 "2018-05-15T00:12:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jason](https://avatars.discourse-cdn.com/v4/letter/j/dc4da7/32.png) [@jason](https://community.graylog.org/u/jason)\
**Post date:** [May 15, 2018, 12:12am UTC](https://community.graylog.org/t/best-way-to-extract-ipv4-addresses-in-a-pipeline/5234/1 "2018-05-15T00:12:22Z")

</div>

Hi there

I want graylog to auto-parse incoming syslog messages and extract srcIP/dstIP pairs. So I came up with this

```auto
rule "function ExtractIPv4Pairs"
when
    regex(".*[^0-9a-zA-Z]([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})[^0-9a-zA-Z].*[^0-9a-zA-Z]([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})[^0-9a-zA-Z].*",to_string($message.message)).matches
then
    let pair = regex(".*[^0-9a-zA-Z]([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})[^0-9a-zA-Z].*[^0-9a-zA-Z]([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})[^0-9a-zA-Z].*",to_string($message.message),["src","dst"]);
    set_field("pipeSrcIPv4",to_ip(pair.src));
    set_field("pipeDstIPv4",to_ip(pair.dst));
end

```

That works fine - except it can match “1.2.333.4” - which is not a valid IP address. This then generates java crash dumps in the server logs as it isn’t parsable/etc

So what I really need to do is ensure each of those quads are between 0 and 255, etc

Does anyone have a “pure” way of extracting IPv4 (IPv6 too would be great) within a pipeline function?

Thanks  
Jason

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [May 15, 2018, 6:40am UTC](https://community.graylog.org/t/best-way-to-extract-ipv4-addresses-in-a-pipeline/5234/2 "2018-05-15T06:40:26Z")

</div>

> [@jason](#):
>
> So what I really need to do is ensure each of those quads are between 0 and 255, etc

You could use a Grok pattern or at least take a look at how the `IPV4` Grok pattern has been defined:

> <https://github.com/Graylog2/graylog2-server/blob/2.4.4/misc/contentpacks/grok-patterns.json#L102-L105>

---

<div class="post-metadata">

**Author:** ![jason](https://avatars.discourse-cdn.com/v4/letter/j/dc4da7/32.png) [@jason](https://community.graylog.org/u/jason)\
**Post date:** [May 15, 2018, 10:25pm UTC](https://community.graylog.org/t/best-way-to-extract-ipv4-addresses-in-a-pipeline/5234/3 "2018-05-15T22:25:03Z")

</div>

OK, good point, I could have googled “ipv4 regex” instead of wasting this lists time 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 29, 2018, 10:25pm UTC](https://community.graylog.org/t/best-way-to-extract-ipv4-addresses-in-a-pipeline/5234/4 "2018-05-29T22:25:18Z")

</div>

Closed on May 29, 2018, 10:25pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.