How IP matching works here
The pattern looks for four runs of 1 to 3 digits joined by dots, with a word boundary on each side so that 192.168.1.10 matches but v192.168.1.10x does not. Common log formats, firewall rules, server output and config files all surface their IPv4s with this pattern.
The match is shape-only. 999.999.1.1 is captured because each group fits the 1 to 3 digit rule, even though no real octet exceeds 255. Filter the output downstream if you only want valid octets, or use extract regex matches with a stricter pattern like \b(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b.
IPv6 addresses are not matched. Their format (eight colon-separated hex groups, with optional :: compression) is different enough that they need their own pattern. Use extract regex matches with an IPv6 pattern when you need them.
How to use extract ip addresses from text
- 1Paste the log, config or text into the input panel.
- 2The output panel shows every IPv4-shaped token, one per line.
- 3Click Copy to copy the list.
- 4Click Download to save it as a plain-text file.
- 5For unique IPs only, send the result to remove duplicate lines.
Keyboard shortcuts
Drive TextResult without touching the mouse.
| Shortcut | Action |
|---|---|
| Ctrl F | Open the find & replace panel inside the input Plus |
| Ctrl Z | Undo the last input change |
| Ctrl Shift Z | Redo |
| Ctrl Shift Enter | Toggle fullscreen focus on the editor Plus |
| Esc | Close find & replace, or exit fullscreen |
| Ctrl K | Open the command palette to jump to any tool Plus |
| Ctrl S | Save current workflow draft Plus |
| Ctrl P | Run a saved workflow Plus |
What counts as an IP here
Four dot-separated digit groups
Each group is 1 to 3 digits. 10.0.0.1, 192.168.1.10 and 203.0.113.42 all match.
Word boundaries on each side
The \b anchors keep the match clean inside prose. "from 192.168.1.10." yields 192.168.1.10 with no trailing dot. Embedded inside identifiers like v192.168.1.10x it still matches because digits and dots are at word boundaries.
No octet validation
Shape-only. 999.999.1.1 is captured because each group is 1 to 3 digits. To restrict to real octets (0-255), use extract regex matches with a stricter pattern.
IPv6 not matched
The pattern is IPv4-only. For IPv6 (e.g. 2001:db8::1) use extract regex matches with a pattern like (?:[A-Fa-f0-9]{1,4}:){2,7}[A-Fa-f0-9]{1,4}.
Order preserved, duplicates kept
IPs appear in source order. Duplicates are not removed; for a unique list pipe through remove duplicate lines.
Worked example
The bogus 999.999.1.1 is captured because each group fits 1 to 3 digits. Filter the output downstream if you only want valid octets.
Allowed: 192.168.1.10 and 10.0.0.5 Gateway 172.16.254.1 Visitor 203.0.113.42 hit /api at 14:30. Bogus 999.999.1.1.
192.168.1.10 10.0.0.5 172.16.254.1 203.0.113.42 999.999.1.1
Settings reference
| Behaviour | Effect on output |
|---|---|
| Group count | Exactly four digit groups separated by three dots. |
| Group length | 1 to 3 digits per group. |
| Octet validation | None. 999.999.1.1 matches the shape. |
| Word boundaries | \b on each side keeps prose punctuation out of the match. |
| IPv6 | Not matched. Use extract regex matches with an IPv6 pattern. |
| Order and duplicates | Source order kept, duplicates kept. |
FAQ
How do I exclude invalid IPs (e.g. 999.999.1.1) from the output?
\b(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b. That requires every octet to be 0-255.Why does an IP inside a version number match?
v1.2.3.4 looks identical to an IPv4 address shape-wise. The matcher does not know context. If your data has many version strings, run find and replace first to mask them, or use a stricter pattern via extract regex matches.Can I extract IPv6 addresses?
(?:[A-Fa-f0-9]{1,4}:){2,7}[A-Fa-f0-9]{1,4} or a more rigorous version that handles :: compression.