Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm searching for a special Regex, that recognizes an IP Adresses after a certain string.

That's the regex for the IP

(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))

The IP follows in my log to

DST=192.168.1.1

Which Regex do i need to just select a IP after DST= but not after SRC=

share|improve this question
2  
...have you tried sticking DST= in the front of the IP regex? Sometimes the simplest solution is the correct one :-) –  voretaq7 Oct 8 '10 at 19:02
    
yes, sure :) but i just wanna mark the ipadress not also the string dst= –  user56548 Oct 8 '10 at 19:23
    
@zordache: I'm using multitail. Tried your regex but it doesn't work. –  user56548 Oct 8 '10 at 19:40

3 Answers 3

up vote 1 down vote accepted

the problem is it finds DST=192.168.1.1 but it should only find 192.168.1.1

It depends a lot on the tool you use. For example with sed this might give you want you want.

echo "... SRC=10.1.1.1 DST=192.168.1.1 LEN=40 ..."  | \
sed -e 's/.*DST=\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/g'

192.168.1.1

See this article about regex grouping.

If you are trying to do highlighting this looks like what you may want/need. From the configuration.

# cs_re_s:<color>:<regular expression>
#             Like cs_re but only the substrings are used(!). E.g.:
#             ^....(...)...(...)
#             In the example above only what matches between '(' and ')' is
#             assigned a color. See the 'acctail' colorscheme for an example.

There is even an example that in that file close to what I believe you want. The example is cs_re_s:cyan:kernel: .*(SRC=[^ ]*) *(DST=[^ ]*) What you want which I think is to highlight anything following a DST may be cs_re_s:red:kernel: .*DST=([^ ]*).

share|improve this answer
    
it doesn't work for multitail, gives me an error in regex - invalid back reference –  user56548 Oct 8 '10 at 20:01
    
Great zoredache, muchas Gracias, it works, your help is highly appreciated –  user56548 Oct 8 '10 at 21:56
DST=(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))
share|improve this answer
    
the problem is it finds DST=192.168.1.1 but it should only find 192.168.1.1. i'm searching for an expression that just finds the ip after DST= –  user56548 Oct 8 '10 at 19:20
1  
the braces should put the ip address into $1, $2, ... –  krissi Oct 8 '10 at 19:51
    
No the braces do pattern repeating. I think you mean "parentheses". –  Dennis Williamson Oct 10 '10 at 0:18

It can be done with lookbehind expression.

regex_test.txt content:

DST=192.168.1.1
SRC=192.168.1.1

then from command line:

   grep -P '(?<=DST=)(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))' regex_test.txt

output:

DST=192.168.1.1

Edit

grep -Po '(?<=DST=)(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))' regex_test.txt

output:

192.168.1.1
share|improve this answer
    
Change the -P to -Po to output only the IP address. –  Dennis Williamson Oct 10 '10 at 0:21
    
You are right. My output statement does not state that it matches only IP. On my terminal DST= is green and 192.168.1.1 is red so it is obvious. –  Casual Coder Oct 10 '10 at 3:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.