Google Groups

Re: [logstash-users] IPV6 support in grok?


Jordan Sissel Feb 8, 2012 4:22 PM
Posted in group: logstash-users


On Wed, Feb 8, 2012 at 3:58 PM, Pradeep Sanders <psan...@ultraviolet.us> wrote:
I propose replacing the IP pattern, which is IPV4 only, with this one to add support for IPV6:

/^(?:(?>(?>([a-f0-9]{1,4})(?>:(?1)){7})|(?>(?!(?:.*[a-f0-9](?>:|$)){8,})((?1)(?>:(?1)){0,6})?::(?2)?))|(?>(?>(?>(?1)(?>:(?1)){5}:)|(?>(?!(?:.*[a-f0-9]:){6,})((?1)(?>:(?1)){0,4})?::(?>(?3):)?))?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\.(?4)){3}))$/iD


It's probably better from grok's point of view to split this pattern into two pieces. IPV4 and IPV6, then have IP be (%{IPV4}|%{IPV6})
 

I ran some tests at regjex.com and it looks good to me.

Side question, if I put this into patterns/mypatterns in my install named IP, will it override the one in the jar file?

I think it should override, but you'll have to test this to be sure.

-Jordan