How use Regex in Graylog

[TiagoAntonio019 (Tiago Antonio)]

Hi guys, I’m a new member here and need a help!
I’m trying to use regex with Graylog, but without success yet.
Example below:
Input:

health,warning PSU1 entered state FAIL
health,warning PSU2 entered state FAIL
health,warning PSU3 entered state FAIL

Regex:

/PSU[1-2]/

The Regex request can’t be found.

I started using Graylog recently, so there’s a chance I’m doing it wrong.

Environment:

• OS: Ubuntu 20.
• Docker version 24.0.0
• Graylog 4.2
• Elasticsearch 7.2
• Mongo 4.2

[gsmith]

Hey @TiagoAntonio019

The general query format is:

field_name:/regular expression/

Example:

srcIP:/127\..+\..+\..+/

[TiagoAntonio019 (Tiago Antonio)]

Hi, thanks for your reply.
It’s not working for me!
For example:
It works:
message: PSU1

Doesn’t work:
message: /PSU1/

When I try to use /PSU[0-9]/ the text turns red.

[ihe]

try to catch your field with an grok pattern in a pipeline into a unique field. Then try to search on that field, and not on the message-field.

[gsmith]

@TiagoAntonio019

When I try to use /PSU[0-9]/ the text turns red.

Try this…

message: PSU1\[0-9\]