Pipeline Rule Filter Question

Graylog Central (peer support)
,
1

Hello GL fans,

Simple pipeline rule question

We are trying to filter out messages with certain file paths in them.

This line works:
regex(“EMSAgent.exe”, to_string($message.full_message)).matches == false

But this one, trying to add the folder paths does not (note that the GUI has big red X on the backslashes till I have 4 of them)…

regex(“MaaS360\\Cloud Extender\\EMSAgent.exe”, to_string($message.full_message)).matches == false

All insight is appreciated

Thanks

TP

2

You are right, java regex requires four backslashes \\\\ to escape one backslash \

I tried your regex and it works for me:

rule "test"
when
    has_field("full_message") AND regex("MaaS360\\\\Cloud Extender\\\\EMSAgent.exe", to_string($message.full_message)).matches == true
then
    let debug_message = concat("maas: ", to_string($message.full_message));
    debug(debug_message);
    set_field("maas", "MaaS360");
end