IPv6 grok pattern does not work with some addresses about logstash-patterns-core

[untergeek]

I think this becomes more pressing with newer versions of Lucene (and therefore Elasticsearch) supporting IPv6 as a valid mapping type.

[ac000]

But that's not a valid IPv6 address. There should not be a double ':' in there.

[jordansissel]

@ac000 agreed, that's not a valid ipv6 address. (16 octets represented, the short-hand :: is used only when fewer octets are shown, right?)

[ac000]

On Mon, 17 Oct 2016 21:18:29 -0700
Jordan Sissel [email protected] wrote:

@ac000 agreed, that's not a valid ipv6 address. (16 octets represented, the short-hand :: is used only when fewer octets are shown, right?)

Yeah, you use '::' where you have more than one block of 0's, but you
can only use it once. e.g

2001:db8::dead:beef:cafe
::1 (loopback address)
:: (unspecified address)
2001:db8:0:dead:beef:cafe:0:1 (single blocks of 0's not displayed with
'::')

2001::abcd::1 is not valid as it's ambiguous as to how many 0
blocks are in each '::'.

2001:0:0:0:abcd:0:0:1 would be written as 2001::abcd:0:0:1 ('::'
is used for the left most block of 0's)

[ac000]

Way to go GitHub! Huh! Those funny block things are 'abcd'

[allyunion]

+1 as loopback is not detected properly in IPv6

[allyunion]

https://gist.github.com/syzdek/6086792

[allyunion]

([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe08:(:[0-9a-fA-F]{1,4}){2,2}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])