Highlighting based on partial text in message field

Graylog Central (peer support)
1

Hi

I have this message in the log

message

ERROR: Backup of VM 424 failed - VM is locked (snapshot)

Of course the number of VM can be different in the future. I would like to highlight this message by red colour if it contains “ERROR: Backup of VM”.

I tried to use followings but without any success

  • “ERROR: Backup of VM”
  • *“ERROR: Backup of VM”*
  • %'“ERROR: Backup of VM”%
  • /.“ERROR: Backup of VM”/.

Is there a way how to highlight message based on partial text?

Thank you, Al

2

Create a pipleine and rule that looks for these messages and if found add a field with a static value, then highlight based on where that static value appears.

Here is an example rule.

rule "Detect VM Backup Failure"
when
  regex("ERROR: Backup of VM \\d+ failed", to_string($message.message)).matches == true
then
  set_field("failed_vm", "true");
end

Then highlight based on failed_vm containing true.