How to Extract IP Address Counts from Access Logs in Python

Read a web server access log, count occurrences of each IP address using regex and Counter, and print the ranked results.

Easy Python 3.9+ Aug 9, 2026 Files & data 17 views 0 copies

regex access log counter file parsing analysis

Python code

33 lines

Python 3.9+

import re
from collections import Counter
from pathlib import Path

def extract_ip_counts(log_file_path):
    ip_pattern = r'^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
    ip_counter = Counter()
    
    with open(log_file_path, 'r') as file:
        for line in file:
            match = re.match(ip_pattern, line)
            if match:
                ip_counter[match.group(1)] += 1
    
    return ip_counter

if __name__ == "__main__":
    log_content = """192.168.1.1 - - [10/Oct/2023:13:55:36] "GET /index.html" 200 2326
10.0.0.1 - - [10/Oct/2023:13:55:37] "GET /about.html" 200 1285
192.168.1.1 - - [10/Oct/2023:13:55:38] "GET /contact.html" 404 372
172.16.0.2 - - [10/Oct/2023:13:55:39] "GET /products" 200 5421
10.0.0.1 - - [10/Oct/2023:13:55:40] "POST /login" 200 1500
192.168.1.1 - - [10/Oct/2023:13:55:41] "GET /help" 500 980"""
    
    temp_file = Path('test_access.log')
    temp_file.write_text(log_content)
    
    counts = extract_ip_counts(temp_file)
    
    for ip, count in counts.most_common():
        print(f"{ip}: {count}")
    
    temp_file.unlink()

Output

stdout

192.168.1.1: 3
10.0.0.1: 2
172.16.0.2: 1

How it works

The function opens the log file and reads line by line, extracting the leading IPv4 address with a regular expression anchored at the start of each line. Each successful match increments the count for that IP using a collections.Counter. Counter.most_common() returns pairs sorted by count in descending order, making it trivial to rank the busiest clients. The script writes a temporary sample log with pathlib, processes it, prints results, and cleans up the file.

Common mistakes

Using `re.search` instead of `re.match` — the address may appear elsewhere in the line, but you want only the start.
Forgetting to close the file manually when not using a context manager, leading to resource leaks.
Assuming every line starts with an IP — non-matching lines are silently ignored, which can hide malformed entries.
Not using `most_common()` when you need a ranked order; a plain dict iteration gives unsorted counts.

Variations

Use a compiled regex object with `re.compile` to avoid recompiling on each call.
Use `defaultdict(int)` instead of `Counter` if you only need grouping without ranking.

Real-world use cases

Detecting abusive clients or potential DDoS sources by counting requests per IP in Nginx or Apache logs.
Monitoring bot traffic intensity across your site to tune rate‑limiting rules.
Tracking which office IPs generate the most logins for security audits or capacity planning.

How to Extract IP Address Counts from Access Logs in Python

Python code

Output

How it works

Common mistakes

Variations

Real-world use cases

More from Files & data

Tutorials

Quizzes

Python code

Output

How it works

Common mistakes

Variations

Real-world use cases

More from Files & data

Keep learning

Tutorials

Quizzes