Fighting the square brackets, need help with regex

Graylog Central (peer support)
1

Hi All,

I need to create a pipeline rule to extract the name of the component from my Mule-based application. This name I then store in a separate field.

Done this many times using simple regex, but the square brackets are causing me headaches.

Example (where I want sphinx-wh-system-api to be extracted)

DEBUG 2024-08-02 13:22:24,053 [[MuleRuntime].uber.1869: [sphinx-wh-system-api].whab-sphinx-main. BLOCKING @1f5b57f5] [processor: whab-sphinx-main/processors/0; event: 1-1153fe20-692f-11ef-b11a-0050569ea35d] org.mule.db.commons.shaded.internal.StatementStreamingResultSetCloser: Closing 1 resultSets

Any tips appreciated

2

Hello @invert123

You would need to escape the brackets, this should give you some idea.

\[(sphinx-wh-system-api)\]

Within Graylog you will need to double escape these kinds of special characters, as below.

\\[(sphinx-wh-system-api)\\]

Hopefully this gets you some of the way to an answer.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.