# How use Regex in Graylog

**URL:** https://community.graylog.org/t/how-use-regex-in-graylog/29664
**Category:** Graylog Central (peer support)
**Created:** [July 26, 2023, 4:50pm UTC](https://community.graylog.org/t/how-use-regex-in-graylog/29664 "2023-07-26T16:50:08Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![TiagoAntonio019](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tiagoantonio019/32/15243_2.png) [@TiagoAntonio019](https://community.graylog.org/u/TiagoAntonio019)
#### Post date: [July 26, 2023, 4:50pm UTC](https://community.graylog.org/t/how-use-regex-in-graylog/29664/1 "2023-07-26T16:50:08Z")

</div>

Hi guys, I’m a new member here and need a help!  
I’m trying to use regex with Graylog, but without success yet.  
**Example below:**  
**Input:**

```auto
health,warning PSU1 entered state FAIL
health,warning PSU2 entered state FAIL
health,warning PSU3 entered state FAIL

```

**Regex:**

```auto
/PSU[1-2]/

```

 ![Screenshot from 2023-07-26 13-35-56](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/606dbdb0928be7bdc793040e5305b1aefbf0b7d3.png)

**The Regex request can’t be found.**

I started using Graylog recently, so there’s a chance I’m doing it wrong.

**Environment:**

- OS: Ubuntu 20.
- Docker version 24.0.0
- Graylog 4.2
- Elasticsearch 7.2
- Mongo 4.2

---

<div class="post-metadata">

### Author: ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [July 27, 2023, 12:28am UTC](https://community.graylog.org/t/how-use-regex-in-graylog/29664/2 "2023-07-27T00:28:16Z")

</div>

Hey @TiagoAntonio019

The general query format is:

`field_name:/regular expression/`

Example:

`srcIP:/127\..+\..+\..+/`

---

<div class="post-metadata">

### Author: ![TiagoAntonio019](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tiagoantonio019/32/15243_2.png) [@TiagoAntonio019](https://community.graylog.org/u/TiagoAntonio019)
#### Post date: [July 27, 2023, 1:06pm UTC](https://community.graylog.org/t/how-use-regex-in-graylog/29664/3 "2023-07-27T13:06:47Z")

</div>

Hi, thanks for your reply.  
It’s not working for me!  
For example:  
It works:  
message: PSU1

Doesn’t work:  
message: /PSU1/

When I try to use **/PSU[0-9]/** the text turns red.

---

<div class="post-metadata">

### Author: ![ihe](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ihe](https://community.graylog.org/u/ihe)
#### Post date: [July 27, 2023, 1:34pm UTC](https://community.graylog.org/t/how-use-regex-in-graylog/29664/4 "2023-07-27T13:34:16Z")

</div>

try to catch your field with an grok pattern in a pipeline into a unique field. Then try to search on that field, and not on the message-field.

---

<div class="post-metadata">

### Author: ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [July 27, 2023, 9:36pm UTC](https://community.graylog.org/t/how-use-regex-in-graylog/29664/5 "2023-07-27T21:36:38Z")

</div>

> [@TiagoAntonio019](#):
>
> When I try to use **/PSU[0-9]/** the text turns red.

Try this…

`message: PSU1\[0-9\]`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [August 10, 2023, 9:37pm UTC](https://community.graylog.org/t/how-use-regex-in-graylog/29664/6 "2023-08-10T21:37:32Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.