Graylog alert conditions not triggered

[Sinagot]

Hey all !

I’m encoutering a very strange problem on Graylog 3.0. I’m trying to create an alert condition which should be raised when Powershell is launched on the remote computer. So the condition is the following :

And the log looks like :

winlogbeat_event_data_Image :
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

So I don’t understand why the alert is not triggering. And it’s on the good stream. I tried with the field named winlogbeat_beat_name, and it works, so I suppose it has to do with the backslash or something else…

[jan (Jan Doberstein)]

the content of the field is actually a search that is done . so you need to escape the \ and . and : in your value.

[Sinagot]

Thank you ! by adding “” to escape special characters it works like a charm !