Grok fails to parse IPv6 addresses

Description

I'm running Logstash 1.2.1 and piping the output of 'varnishncsa' with a custom output format.

The output contains the remote address which might be IPv4 or IPv6.

In grok I'm using: %{IP:remote}

That works fine for a IPv4 address, but with IPv6 it fails with a Grok parse failure.

Now, I'm not a regex guru, but for example the IP it fails on: 2a00:f10:113:0:16da:e9ff:fe71:cc39

Any ideas?

Gliffy Diagrams

Activity

Show:

Details

Assignee

Reporter

Affects versions

Created October 28, 2013 at 1:08 PM
Updated March 25, 2015 at 5:38 AM