Hello everyone,
I need to extract the first IP from ASA events, after the first IP sometimes there are 3 other IPs, sometimes 2, and sometimes 1 IP, but I need only the first one without depending on how many IPs are after the first.
2023-07-13T11:24:25+02:00 FirASA : %ASA-6-302013: Built inbound TCP connection 2907550162 for dmzIB:192.168.7.7/49446 (192.168.7.7/49446) to inside:10.100.40.4/8080 (10.100.40.4/8080)
Thank you.
Try adding the following to establish the boundary of the IP and search past the ASA message. This will get the first available IP address. If this works for you please be sure to grant some karma!
| rex field=_raw "ASA\-\d\-\d+\:.+?(\b(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"
Hello,
The script above is very helpful, but I just need to add one more criterion:
It should recognize the first IP that comes after the string "%ASA" because sometimes it recognizes the IP of the firewall which is the first one in the event and is always before the string "%ASA".
Thank you.
Try adding the following to establish the boundary of the IP and search past the ASA message. This will get the first available IP address. If this works for you please be sure to grant some karma!
| rex field=_raw "ASA\-\d\-\d+\:.+?(\b(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"