comma separate syslog regex

Why not just split the string at the comma and get item[17] (the eighteenth element) from the resulting array?

String string = "Jul 22 17:36:52 filterlog: 115,16777216,,1433788744,enc0,match,pass,in,4,0x0,,254,15282,0,none,1,icmp,60,172.24.4.1,10.10.1.62,request,6546,820140";
String[] item = string.split(",");

//item[17] should have what you need

Select allOpen in new window

i don't think that is possible in vmware log insight
http://pubs.vmware.com/log-insight-20/index.jsp#com.vmware.log-insight.user.doc/GUID-5553DE45-6871-4F28-85C2-867D0F72AAA1.html

It seems you are interested in the first IP address.  Try:
\d+\.\d+\.\d+\.\d+

In the actual java code, you would need to escape the backslashes, so if the above doesn't work, try:
\\d+\\.\\d+\\.\\d+\\.\\d+

no im also interested i the second IP, and the ports and the interface and the rule number and if its in or out and if its blocked or passed
and so on... that why i need to be able to say get the chars after this amount of comma's

please state your requirements clearly.

In your original post I can see

for example will extract everything after the 18th comma until the 19th comma:

In a subsequent post you state

i need to be able to say get the chars after this amount of comma's

In another post you state

i don't think that is possible in vmware log insight

Can you explain why not?

i need a regex which in which i can say after you came a cross x amount of comma's (no matter if it were ,,, or ,1234,12345,123,) give me everything after that comma until the next comma.

In vmware log insight i can extract field. The field extraction is done for me, i just need to tell log insight where it is in the text

the problem is the only consistent thing is the number of "," in front of it.

see the attachment.
so it is about the pre and post context
2015-07-22-21-17-32.png

thanks a lot, I have one more question.
(?:[^,]*,){8} after the 8th comma there will always be a 4 or a 6.
is it possible to only get lines where there is a 4 after the 8th comma.

Using the example input string you provided, if you enter the following in the Pre-Context box:
(?:[^,]*,){8}4

and then:
([^,]+)
In the Extracted Value box, then it should capture "0x0" (again, I am using the example string you posted.  If the sample string had a 6 instead of a 4, then it wouldn't match that row.