Grok fails to parse IPv6 addresses
Description
testing discovered
Gliffy Diagrams
Activity
Show:
Details
Details
Assignee
Philippe Weber
Philippe WeberReporter
Wido den Hollander
Wido den HollanderLabels
Affects versions
Created October 28, 2013 at 1:08 PM
Updated March 25, 2015 at 5:38 AM
I'm running Logstash 1.2.1 and piping the output of 'varnishncsa' with a custom output format.
The output contains the remote address which might be IPv4 or IPv6.
In grok I'm using: %{IP:remote}
That works fine for a IPv4 address, but with IPv6 it fails with a Grok parse failure.
Now, I'm not a regex guru, but for example the IP it fails on: 2a00:f10:113:0:16da:e9ff:fe71:cc39
Any ideas?