Pipeline Rule Simulator not working with domain\username in the log, but external Grok debuggers function as expected

New to Graylog Community? READ-ME FIRST Guides
1

Hello all, i am trying to use a pipeline rule to extract some information from a log line, but the simulator is indicating the rule / grok is not working when a domain / username is present in the log. external grok debuggers all work as expected. a bit puzzling but i am probably missing something simple

the grok is
contains(to_string($message.source_os_type),“vmware”) //&& !contains(to_string($message.message),“com.vmware.vim.eam”)
then
let tmp = grok(
pattern: “vim.event.%{WORD:event_action}] \[%{WORD:event_severity}\]”,
value: to_string($message.message),
only_named_captures: true
);
set_fields(tmp);
//remove_field(“tmpsource”);
end

Does not work with simulator
message:Event [119797857] [1-1] [2024-08-23T14:29:22.695142Z] [vim.event.VmCreatedEvent] [info] [domain.domain.domain.com\user-name] [xxxxx Datacenter RKPT] [119797851] [Created virtual machine computer1 on vmwarehost, in XXXXXX Datacenter XXX]
source_os_type:vmware

removing the [domain.domain.domain.com\user-name] from the log entry works every time. i will extract the domain \ username in a later rule, but i just want to ignore everything after [info]

any thoughts or suggestions?

2

Hey @jmmats,

Certain characters, such as ‘[’, require a double escape within Graylog. The below should hopefully work.

let tmp = grok(
pattern: “vim.event.%{WORD:event_action}] \[%{WORD:event_severity}\]”,
value: to_string($message.message),
only_named_captures: true
);

3

yes you are correct @Wine_Merchant , i do have that in my rule. i must have just copied the external grok debugger rule and pasted.

this is the rule text in place now
pattern: “vim.event.%{WORD:event_action}\] \[%{WORD:event_severity}\]”,

Very perplexing imo.

doesnt work
message:Event [119797857] [1-1] [2024-08-23T14:29:22.695142Z] [vim.event.VmCreatedEvent] [info] [do.main.local\Admin-user] [ Datacenter RKPT] [119797851] [Created virtual machine xxxxxx on hypervisor.y.y.z, in Datacenter RKPT]
source_os_type:vmware

removing - [do.main.local\Admin-user] from the log line

works
message:Event [119797857] [1-1] [2024-08-23T14:29:22.695142Z] [vim.event.VmCreatedEvent] [info] [ Datacenter RKPT] [119797851] [Created virtual machine xxxxxx on hypervisor.y.y.z, in Datacenter RKPT]
source_os_type:vmware

I have even tried adding a greedydata to the end with no success unfortuantely.

4

i should also mention that the post seems to be removing the double backslash from the pattern, as your post shows as well

5

for clarity here, it seems as if the backslash in the domain username text is causing the issue

[do.main.local\Admin-user]

6

It does appear to work within the rule simulator, which is not so robust.

Screenshot 2024-09-11 at 15.54.15
Screenshot 2024-09-11 at 15.54.151692×1534 338 KB

Have you now got it working?

7

oy, yeah seems to be working now. though i was using the key value to mimic the field of source_os_type i have set. will have to do some additional troubleshooting but i think ill move forward with this.

thanks again for the guidance.