# Correct RegEx depicted as Syntax Error

**URL:** <https://community.graylog.org/t/correct-regex-depicted-as-syntax-error/26289>\
**Category:** Graylog Central (peer support)\
**Created:** [October 25, 2022, 2:18pm UTC](https://community.graylog.org/t/correct-regex-depicted-as-syntax-error/26289 "2022-10-25T14:18:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmuensterer](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dmuensterer/32/13602_2.png) [@dmuensterer](https://community.graylog.org/u/dmuensterer)\
**Post date:** [October 25, 2022, 2:18pm UTC](https://community.graylog.org/t/correct-regex-depicted-as-syntax-error/26289/1 "2022-10-25T14:18:33Z")

</div>

I’ve just found some error messages in my logs caused by a (automatically translated) sigma rule which contains the following search string, showing an error message:  
`(ParentImage:/c\:\\windows\\temp\\/) AND (Image:/c\:\\windows\\temp\\helper\\.*/)`  
This is however correct syntax and should also be correct Graylog syntax. The following works without any issues:  
`(ParentImage:/c\:\\windows\\temp/) AND (Image:/c\:\\windows\\temp\\helper\\.*/)` (notice the missing \\ at the end of the first regex string).

I understand that it would be way more efficient not to use regex here but I was interested in what causes this issue. Any ideas?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [October 25, 2022, 9:28pm UTC](https://community.graylog.org/t/correct-regex-depicted-as-syntax-error/26289/2 "2022-10-25T21:28:03Z")

</div>

hello @dmuensterer

> [@dmuensterer](#):
>
> I’ve just found some error messages in my logs caused by a (automatically translated) sigma rule

Can you post the full error message and/or messages from this issue? And versions of Graylog/ES or Mongo would help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 8, 2022, 9:28pm UTC](https://community.graylog.org/t/correct-regex-depicted-as-syntax-error/26289/3 "2022-11-08T21:28:51Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.