AD FS 通过正则表达式记录多个 ip 提取

Question

Stuck on pcre regex question. I am trying to extract all ips following a field ("Client IP: ") in a AD FS log.
My log looks like this (truncated to save space):

EventCode=411
EventType=0
Type=Information
SidType=1
TaskCategory=Printers
OpCode=Info
Token Type: 
http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName  

Client IP: 
110.19.100.155,2603:1032:205:14::5 

Error message: 
******-This user can't sign in because this account is currently disabled 

So the end result desired is that I get both ip addresses under the field src_ip, and that it only tries the regex if it finds the EventCode=411 or 512, etc...

What I have so far is this:

(\s\n|,)(?<src_ip>(?:(?:\d{1,3}\.){3}(?:\d{1,3}))|(?:(?:::)?(?:[\dA-Fa-f]{1,4}:{1,2}){1,7}(?:[\d\%A-Fa-z\.]+)?(?:::)?)|(?:::[\dA-Fa-f\.]{1,15})|(?:::))

This works but does not differentiate for events with only the required Event Codes. So when I do this:

(?ms)(?:EventCode=(411|512))\n.*?(\s\n|,)(?P<src_ip>(?:(?:\d{1,3}\.){3}(?:\d{1,3}))|(?:(?:::)?(?:[\dA-Fa-f]{1,4}:{1,2}){1,7}(?:[\d\%A-Fa-z\.]+)?(?:::)?)|(?:::[\dA-Fa-f\.]{1,15})|(?:::))

It only picks up the first ip.

Any ideas?

Answer 1

You may slightly modify your pattern by adding a custom boundary based on the \\G operator that matches the start of a string or, what you need here, the end of the previous successful match:

(?ms)(?:\G(?!\A)\s*,\s*|EventCode=(411|512)\n.*?\R)\K(?P<src_ip>(?:\d{1,3}\.){3}(?:\d{1,3})|(?:::)?(?:[\dA-Fa-f]{1,4}:{1,2}){1,7}[\d%A-Fa-f.]*(?:::)?|::[\dA-Fa-f.]{1,15}|::)

See the regex demo .

Basically, the main difference is (?:\\G(?!\\A)\\s*,\\s*|EventCode=(411|512)\\n.*?\\R)\\K :

• \\G(?!\\A)\\s*,\\s* - the end of the preceding successful match (the start of string position has been subtracted with the negative lookahead (?!\\A) ), then a comma enclosed with 0+ whitespaces
• | - or
• EventCode=(411|512)\\n.*?\\R - EventCode= substring, then (411|512) captures 411 or 512 into Group 1, then \\R matches a line break and .*?\\R matches any amount of 0+ chars as few as possible up to another line break that will be followed with subsequent subpatterns)
• \\K - match reset operator discarding all text matched so far from the whole match buffer.

You also had a slight issue: [\\d\\%A-Fa-z\\.] should be written as [\\d\\%A-Fa-f.] .