Graylog alert conditions not triggered

Hey all !

I’m encoutering a very strange problem on Graylog 3.0. I’m trying to create an alert condition which should be raised when Powershell is launched on the remote computer. So the condition is the following :

And the log looks like :

winlogbeat_event_data_Image :

So I don’t understand why the alert is not triggering. And it’s on the good stream. I tried with the field named winlogbeat_beat_name, and it works, so I suppose it has to do with the backslash or something else…

the content of the field is actually a search that is done . so you need to escape the \ and . and : in your value.

Thank you ! by adding “” to escape special characters it works like a charm !

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.