Pretty straightforward regex, I am trying to extract IP from logs. But group(1) is empty, which is given. Is there a better way to approach this problem?

sourceip_regex_extract = re.compile(r"{}".format(sourceip_syslog_regex))
sourceip_extract = sourceip_regex_extract.search(message) 
sourceip_txt = sourceip_extract.group(1)

Regex101: https://regex101.com/r/jmtQci/1

CodePudding user response：

First of all, when you search for a match with a regex, make sure you actually get a match and only then access the first group value.

Next, r"{}".format(sourceip_syslog_regex) makes no sense, it is the same as sourceip_syslog_regex.

To fix the current issue, you can use a (?:from |inside:) alternation to match either from or inside:

sourceip_syslog_regex = r'(?:from |inside:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
sourceip_regex_extract = re.compile(sourceip_syslog_regex)
sourceip_extract = sourceip_regex_extract.search(message) 
if sourceip_extract:
    sourceip_txt = sourceip_extract.group(1)

See the regex demo

Note you can shorten the IP address matching pattern a bit and use (?:from |inside:)(\d{1,3}(?:\.\d{1,3}){3}).

Details:

• (?:from |inside:) - either from or inside:
• (\d{1,3}(?:\.\d{1,3}){3}) - Group 1: one to three digits and then three occurrences of a . and one to three digits.