How to get only last IP from one or many divided by comma on beginning of the line

Question

Hi,

I would like to parse log files, I need to get only last IP from one or many divided by comma on beginning of the line:

This is how the lines look like:

80.250.5.1 - - [26/Oct/2010:13:10:14 +0200] ...
80.250.5.1, 80.250.5.2 somethingA - [26/Oct/2010:13:10:14 +0200] ...
80.250.5.1, 80.250.5.2, 80.250.5.3 - somethingB [26/Oct/2010:13:10:14 +0200] ...

I need to get:

80.250.5.1 - - [26/Oct/2010:13:10:14 +0200] ...
80.250.5.2 somethingA - [26/Oct/2010:13:10:14 +0200] ...
80.250.5.3 - somethingB [26/Oct/2010:13:10:14 +0200] ...

Note: There is never comma in somethingA and somethingB columns, this my help. There may be more commas in next columns after the [date].

I have tried to test few first columns and delete them if there is comma in it, but the problem is that sometimes there are more than 10 IPs there.

This works for 2 IPs:

awk '{if ($1 ~ /,/) {$1=""}; if ($2 ~ /,/) {$2=""}  }1'

My idea is to do something like "if there is comma before [, delete everything before comma, otherwise keep it unchanged". Unfortunately, my sed/awk skills are not good enough to do this.

Thanks a lot for any help.

Answer 1

sed -r 's/^(([0-9]+\.){3}[0-9]+, )*(.*)$/\3/'

([0-9]+\.){3}[0-9]+) captures an IP address.

([0-9]+\.){3}[0-9]+, )* repeats capturing until there are no more addresses followed by a comma left, which means that the rest of the line is exactly what we need (please note that the last (or only) address is not followed by the comma).

The last step is to instruct sed to replace a whole input line with what it has captured in the third group of brackets (hence \3 at the end of the expression), which gives us a desired result.

Answer 2

Are there any other commas in the line? If not, you can do:

awk -F, '{ print $NF }'

This will leave leading whitespace than you can trim away if desired, using either of these:

awk -F, '{ print $NF }' | sed 's/^ *//'
awk -F, '{ print gensub(/^ */, "", "G", $NF) }'

In awk, the built-in variable NF returns the number of fields on the input line, so printing $NF will print the last field in the line. Thus if there are more commas on the input line, you won't get the output you want.

Note that the use of single quotes is critical (don't use double quotes otherwise $NF is expanded by the shell rather than passed through to awk).