Expression to check agent form Apache log and extract IP if apache status code 200
<p>I need get create a regex rule for extract second Ip on my apache log, for security questions.</p>

<p>But i don't know how to filter agent</p>

<p>I need extract second IP on log (<strong>121.54.54.226</strong>) when agent condition = <strong>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1</strong></p>

<pre><code>176.XX.XX.233 121.54.54.226 - - [22/Aug/2016:10:44:12 +0200] "POST /wp-login.php HTTP/1.1" 200 3714 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
</code></pre>

<p>For get IP on wordpress failed login work for me: (extract 121.54.54.226)</p>

<pre><code>\s(\S+).*] "POST \/wp-login\.php.*" 200
</code></pre>

<p>But when try filter for agent fails</p>

<pre><code>\s(\S+).*] "POST \/wp-login\.php.*" 200 \d+ \"\-\" \""Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko\/20100101 Firefox\/40.1"\"
</code></pre>

<p>No matches.</p>