Converting Regex Based Streamline into Pipeline Rules

[psankar (Pranav Sankar)]

Hello all,

I’m a new user on Graylog, and I have a question with Streamline/pipeline and regex value :

I receive specific logs that contain users info where i need to detect suspicious gmail users.I’ve created a streamline "regular expression (username|userName|sub)\W+[^@]+@gmail.com " to detect such users with gmail domain.

Now i need to create a Graylog Pipeline for such regex patterns. I never created pipeline based on regex.

How to create this pipeline with a regex search?

Thanks
Pranav

[tmacgbay]

Here is the start of a good read on creating pipelines for security that goes into a lot more detail than the Graylog docs. The short story is you connect a Stream (That leads to a storage index) to an Input, then connect the pipeline to the stream, and have rules built into your pipeline that manipulate the date… in your case regex commands.

Detecting Threats with Graylog Pipelines - Part 1

Give it a shot and see what you can do!