Pipeline rule, multiple values using regex function return an empty table

Graylog Central (peer support)
,
8

Hi @macko003 thanks for your help …

It has the taste of a bug :smile:

last test (i tested with the “matches” on when condition too but without result) :

rule "Generic REGEX quote extractor"
when
    true
then
debug ($message.syslog_message);
let result = regex("\'.*?\'",to_string($message.syslog_message));
debug (result);
set_fields(result);
end

Debug() output:

2019-01-17 16:18:21,607 INFO : org.graylog.plugins.pipelineprocessor.ast.functions.Function - PIPELINE DEBUG: start archive cleaner on channel '2025279_multi'|#phanes,ott,support,local4
2019-01-17 16:18:21,607 INFO : org.graylog.plugins.pipelineprocessor.ast.functions.Function - PIPELINE DEBUG: {}
2019-01-17 16:18:21,611 INFO : org.graylog.plugins.pipelineprocessor.ast.functions.Function - PIPELINE DEBUG: start purge channel '2025279_multi' from '1' (1970-01-01 00:00:01) to '1547741586' (2019-01-17 16:13:06)|#phanes,ott,support,local4
2019-01-17 16:18:21,611 INFO : org.graylog.plugins.pipelineprocessor.ast.functions.Function - PIPELINE DEBUG: {}

Regex() is still catching nothing …