Question

我需要编写一个正则表达式，它将列出日志中的所有IP地址。地址应具有不同的组，因此不应仅匹配完全匹配。 IP地址的数量不是恒定的。日志看起来像这样

<177>Jun 28 15:35:15 src=192.168.100.122 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Null scan (attempts with response: 144, attempts without response: 0, targets: 56, port(s): 443, 80, 5274, 445, 88, 4120, 135, 49155). targetList: 12.97.135.114, 18.232.35.16, 10.10.202.7, 10.101.90.178, 30.101.124.18, 13.107.3.128, 10.83.127.51, 12.160.91.170, 10.101.124.34, 10.10.200.12

到目前为止，我已经写了这样的东西：

targetList: ([0-9\.\,\s]*)

但是它将所有地址合并为一个大组，每个地址应该只有一个组，并且不应有空格或qoma符号。

我还使用https://regex101.com/查找正确的正则表达式

Answer 1

我尝试了以下正则表达式来匹配IPV4地址，并成功运行，如下所示：-

https://regex101.com/r/JxzSb8/1

用于IPV4地址的正则表达式：->

(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])

如果要搜索IPV6地址，可以使用以下正则表达式

用于IPV6地址的正则表达式：->

((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?

用于打印IPV4地址列表的程序：->

#!/usr/bin/perl
$num = '<177>Jun 28 15:35:15 src=192.168.100.122 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Null scan (attempts with response: 144, attempts without response: 0, targets: 56, port(s): 443, 80, 5274, 445, 88, 4120, 135, 49155). targetList: 12.97.135.114, 18.232.35.16, 10.10.202.7, 10.101.90.178, 30.101.124.18, 13.107.3.128, 10.83.127.51, 12.160.91.170, 10.101.124.34, 10.10.200.1';

print "num : $num";

print "\n\nList of IPV4 Addresses:->";

while ($num =~ m/((?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))/gm) {
    #matched text = $&
    print "\n$1";
}

您可以在这里找到有用的正则表达式列表：->

https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns

使用PCRE正则表达式列出LOG中的所有ipv4地址

1 个答案: