fix issue parsing dns.ip

logstash/pipelines/zeek/12_zeek_mutate.conf

@@ -410,7 +410,7 @@ filter {
       ruby {
         id => "ruby_zeek_dns_answers_ip_extract"
         # todo: adjust this regex so it at least sort of catches IPv6 as well
-        code => "event.set('[@metadata][answers_ip]', event.get('[zeek][dns][answers]').scan(/\d+\.\d+\.\d+\.\d+/).join(','))"
+        code => "event.set('[@metadata][answers_ip]', event.get('[zeek][dns][answers]').scan(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/).join(','))"
       }
       mutate { id => "mutate_split_zeek_dns_answers"
                split => { "[zeek][dns][answers]" => "," } }