使用正則表達式從兩個不同的日志樣本中提取源 IP 地址

Question

我有一個正則表達式如下：

"id.resp_h"|"rx_hosts":(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),

我正在嘗試從兩個不同的日志樣本中提取源 IP 地址。 “id.orig_h”和“tx_hosts”是源IP的兩個不同字段。 我如何忽略語音標記和方括號？ 我只想提取 IP 地址

schema_id=17127524534057985804:skip_writers="":{"_path":"conn","_system_name":"hostname","_write_ts":"2020-01-12T22:09:28.853417Z","ts":"2020-01-12T22:07:14.642074Z","uid":"Cm4cbmvRjlmd2I52c","id.orig_h":"192.168.1.1","id.orig_p":xxx,"id.resp_h":"192.168.1.2","id.resp_p":xxx,"proto":"udp",

schema_id=17223896091372211545:skip_writers="":{"_path":"files","_system_name":"Hostname","_write_ts":"2020-01-12T22:09:00.016260Z","ts":"2020-01-12T22:07:14.108217Z","fuid":"FnmzOv3Fkhr8lP0qL","tx_hosts":["192.168.1.1","192.168.1.1"],"rx_hosts":["192.168.1.10"],

任何幫助將不勝感激:-)

謝謝，JM

Answer 1

如果你想用正則表達式解決它，試試這個：

(?:"id.resp_h"["[:] |"rx_hosts"["[:] )(\\d{1,3}.\\d{1,3}.\\d{1,3}.\\d {1,3})

看這里