Hey all !
I’m encoutering a very strange problem on Graylog 3.0. I’m trying to create an alert condition which should be raised when Powershell is launched on the remote computer. So the condition is the following :
And the log looks like :
So I don’t understand why the alert is not triggering. And it’s on the good stream. I tried with the field named winlogbeat_beat_name, and it works, so I suppose it has to do with the backslash or something else…