My objective here is to determine how many times my PCs are being rebooted but I am only interested if this happens during business hours.
My PCs are all Win7 and I am using NXlog to collect the logs, the log that tells me that a PC has been rebooted are
2018-09-16 02:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 08:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 01:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 02:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 10:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 11:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 13:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 19:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 23:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 10:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 16:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 02:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 22:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 17:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 21:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 15:37:16 testpc.local INFO 6006 The Event log service was stopped.
2018-09-16 10:37:16 testpc.local INFO 6006 The Event log service was stopped.
So this is my sample data.
My though here is that I could query the logs using a regular expression to find the events during business hour. For that I came up with this regex.
\d{4}-\d{2}-\d{2} (08|09|10|11|12|13|14|15|16|17)
Which I have validated here:
And in looking at the documentation for elastic search here
https://www.elastic.co/guide/en/elasticsearch/reference/5.6/query-dsl-regexp-query.html#regexp-syntax
it says that the regex has to match the entire field
"Lucene’s patterns are always anchored. The pattern provided must match the entire string"
So, based on this I added " .* " to my query, which now is
\d{4}-\d{2}-\d{2} (08|09|10|11|12|13|14|15|16|17).*
So in graylog my complete query is:
/^\d{4}-\d{2}-\d{2} (08|09|10|11|12|13|14|15|16|17)/ AND “The Event log service was stopped” AND EventID:6006
But for some reason that I cant understand this is not working for me, it is not returning anything.
My Graylog version is 2.4.5
Any help will be much appreciated.