How to use grok pattern to capture multi IP in one message?

Graylog Central (peer support)
1

How to use grok pattern to capture multi IP in one message?

I have some message like:

<164>1.2.3.4 %ASA-4-419002: Duplicate TCP SYN from External:1.2.3.4/57897 to External:1.2.3.4/53 with different initial sequence number

<164>1.2.3.4 %ASA-4-313004: Denied ICMP type=0, from laddr 1.2.3.4 on interface Internal to 1.2.3.4 no matching session

I tried to use %{IP:source}, but it only extract the first IP. But I actually need from and to . Can anyone give me a hand. Thanks.

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.