The TL;DR is that i’m trying to make a pipeline with a rule that parses my bind9/named query log messages.
New to graylog pipelines but not new to regex 
But a trued and tried regex that works in regex testers with my message text gives bunch of errors in Graylog pipeline rule editor. It’s a valid Javascript regex as far as i can see. Tested in regex101
And i don’t understand why.
Example string to be parsed:
ns1 named[47638]: client @0x7f61fd6a0b68 10.10.10.10#49172 (www.domain.tld): query: www.domain.tld IN A + (10.10.10.2)
My Regex:
let result = regex("^(ns\d) .+ client (@\S+) ([0-9\.:]+)#(\d+) \((\S+)\): query: (\S+) (\w+) (\w+) ([0-9\+A-Z]+) \((.+)\)$",to_string($message.message));
As somebody will surely ask for the whole rue here it is:
rule "NS Bind9 Query message parser"
when
has_field("message") && contains(to_string($message.message),"ns1 named") && contains(to_string($message.message),"query: ")
OR
has_field("message") && contains(to_string($message.message),"ns2 named") && contains(to_string($message.message),"query: ")
then
let result = regex("^(ns[0-9]) .+ client (@\S+) ([0-9\.:]+)#(\d+) \((\S+)\): query: (\S+) (\w+) (\w+) ([0-9\+A-Z]+) \((.+)\)$",to_string($message.message));
set_field("nameserver", result["0"]);
set_field("clientobject", result["1"]);
set_field("src_ip", result["2"]);
set_field("src_port", result["3"]);
set_field("clientquery", result["4"]);
set_field("query_domain", result["5"]);
set_field("query_class", result["6"]);
set_field("query_type", result["7"]);
set_field("query_flags", result["8"]);
set_field("query_nameserver", result["9"]);
end
What am i doing wrong here in the regex?
What syntax/lint problems am i overseeing, i must be blind ?
PS. The extractor Feature seems to well integrated and preforms, why is there no talk about extractors and even the link to extractors docs is not working within Graylog self.? Are Extractors just and old “feature” that is not yet removed and should not be used ? Is it deprecated or not ?
