So what I’m trying to do is extract an ip address from my log - which seems simple enough until you realize there’s 4-5 of them in each log. So essentially I want it to look for … which you would use regex .+ for that, at least I assume so. Then directly after those 3 dots extract the ip address. R…

Hello, I was going to suggest using GROK, but since there are 4-5 IP address, if I’m correct, I’m not sure. Have you tried asking HowTo in Graylog Discord?

I found this, perhaps it will help. [image] Pipeline rule to generate a Object field with obtained IPs (multi_value) for a QNAME, from a DNS LookUp Table Graylog Central (peer support) Spent too long on this, here is what I came up with: let lookup_IPs_json = parse_json(…

It would be helpful if you could post a sample of the log you are trying to extract an IP address for. Otherwise, here is an untested pipeline rule that may get you what you need: rule "Extract Source IP" when regex(".+?[.]{3}(\\d+\\.\\d+\\.\\d+\\.\\d+)", to_string($message.message)).matches =…

Pipeline hangup

Graylog Central (peer support)

gsmith (GSmith) July 16, 2022, 2:32am 3

I found this, perhaps it will help.

Topic		Replies	Views
Best way to extract IPv4 addresses in a pipeline? Graylog Central (peer support) pipeline-rules , dump-messagespl	2	3440	May 15, 2018
Assistance with extractors Graylog Central (peer support)	13	1730	July 5, 2022
Pipeline rule, multiple values using regex function, only possible to return value ["0"] Graylog Central (peer support) pipeline-rules , debuggingpl	1	2306	April 13, 2020
Finding ip addresses in message fields Graylog Central (peer support)	3	1945	December 5, 2023
Pipeline for creating a GeoIP dashboard Graylog Central (peer support) pipeline-rules , dashboards	11	2402	August 12, 2022

Pipeline hangup

Related topics