On Oct 31, 2014 4:24 PM, "Evan Rempel" <erempel@uvic.ca> wrote:

There are a number of occurrences in log lines that are of the form {address}:{port}

This is fine for IPv4 addresses 127.0.0.1:123 which can be matched with @IPv4@:@NUMBER@

If the address is a complete IPv6 address with port 2607:f8f0:c10:fff:200:5efe:ce57:5330:123 the
same pattern can be used to match it @IPvAny@:@NUMBER@

If the IP address is a shortform IPv6 address such as ::ffff:127.0.0.1 and adding the port number
::ffff:127.0.0.1:123  this fails to be matched by @IPvAny@:@NUMBER@

Has anyone else seen bumped into this issue?

For anyone taking a stab at this, this page looks interesting

http://rosettacode.org/wiki/Parse_an_IP_Address


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq