Case-Insensitive

[cmd1775]

Can someone please tell me how I can do case-insensitive queries in Graylog? For example, if I want to search for a username of “joeblow” where any character could be upper or lower case.
Thank you,

[cmd1775]

I know I can do /[Jj][Oo][Ee][Bb][Ll][Oo][Ww]/ but was hoping for something a little more friendly to type out.
Thank you,

[lindonm (Lindon Morris)]

I don’t believe that is possible, the recommendation is to lowercase everything as you ingest it.

Case insensitive search in GROK extracted field

Hi all, I have a simple GROK extractor parsing various DATA fields, assigning custom names to each one. In the search window, I would like to do a case insensitive search in some of these field, but I can not see how. For example, I have a field called “result” which contain the word “Accepted”. Searching for it, I need to type “result:Accepted”, because something as “result:accepted” will not work. How can I search for “result:accepted” for any field having something like “Accepted”, “accept…

[cmd1775]

Thank you! I will give this a try.

[BlueTeamNinja (aBe)]

set_field(lowercase($message.username)) is your best friend in pipelines.

[cmd1775]

Thank you very much. This worked like a charm!