in reply to Regex substitute matches second match first?
That is good, but as I said only one IP needs to be captured - the maverick in the second lot of []'s from postfix logs.
nick