title: filter only ip from the http error log using awk
body: <p>i am using  below command in my bash script which filters failed ip from the log:</p>
  <pre><code>tail -1000 /var/log/secure | awk '/sshd/ &amp;&amp; /Failed password for/ { if (/invalid user/) try[$13]++; else try[$11]++; }
  </code></pre>
  <p>this is working fine for the ssh logs under var/log/secure where ip address unique</p>
  <p>i am trying the same for the http error log
  but in http error log  the ip is combined with ip:port eg 1.1.1.1:44848
  while running the below comman it</p>
  <pre><code>tail -1000 /var/log/httpd/error_log | awk '/denied/ &amp;&amp; /client/ { if (/invalid user/) try[$12]++; else try[$10]++; }
  </code></pre>
  <p>try[$10] is the value for ip:port  but it outputs empty value.</p>
  <p>here is the script i used to block ssh failed attempts
  <a href="https://striker24x7.blogspot.com/2011/07/automatic-blocking-hackers-ip-who.html" rel="nofollow noreferrer">[LINK]</a></p>
  <p>and i am trying to achive similar for http error logs</p>
  <p>[Mon Sep 27 00:20:20.195139 2021] [access_compat:error] [pid 17100] [client 192.241.208.127:38700] AH01797: client denied by server configuration: /var/www/html/hudson
  [Mon Sep 27 00:26:37.161248 2021] [access_compat:error] [pid 17097] [client 216.218.206.67:58598] AH01797: client denied by server configuration: /var/www/html/</p>