How to use grok pattern to capture multi IP in one message?
I have some message like:
<164>1.2.3.4 %ASA-4-419002: Duplicate TCP SYN from External:1.2.3.4/57897 to External:1.2.3.4/53 with different initial sequence number
<164>1.2.3.4 %ASA-4-313004: Denied ICMP type=0, from laddr 1.2.3.4 on interface Internal to 1.2.3.4 no matching session
I tried to use %{IP:source}, but it only extract the first IP. But I actually need from and to . Can anyone give me a hand. Thanks.