Networking – How to extract IP address from the log’s string with regular expression and Notepad++

networkingnotepadregex

I've such kind of strings from the log file

rule family="ipv4" source address="54.246.81.158" reject
rule family="ipv4" source address="175.36.129.24" reject

How can I match an IP address from every of that string and then replace the original one with matched IP using regular expression in Notepad++ text editor?

Expected result:

54.246.81.158
175.36.129.24

I prefer to achieve the goal usig regexp and Search and replace only.
If it ever possible in Notepad++
I know that I can use macro functionality, but I don't want to do so.

So, at first, we'll match IP with regexp (\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}). At second we replace original string with IP from step #1
But I'm not sure if it ever possible using Notepad++.
If I'm failed with this, I'll use vim :-)

Best Answer

  • Ctrl+H
  • Find what: ^.+?((?:\d+\.){3}\d+).+$
  • Replace with: $1
  • check Wrap around
  • check Regular expression
  • DO NOT CHECK . matches newline
  • Replace all

Explanation:

^           : beginning of line
.+?         : 1 or more any character but newline
(           : start group 1
  (?:       : start non capture group
    \d+     : 1 or more digit
    \.      : a dot
  ){3}      : end group, must appear 3 times
  \d+       : 1 or more digit
)           : end group 1
.+          : 1 or more any character but newline
$           : end of line

Replacement:

$1          : content of group 1 (ie. the IP)

Result for given example:

54.246.81.158
175.36.129.24

To be sure you have an IP address, use 

((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?\.){3}(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)))

instead of

((?:\d+\.){3}\d+)
Related Question