This might be a general regex problem, but I’ve confirmed it works and captures the MAC address on regexr.com and PowerShell. Expression ^dhcpd[\d+]:\s\w+\s(?:from|to)\s(.+?)\s.+$ Test String dhcpd[89514]: DHCPDISCOVER from 12:e4:88:ac:cd:12 via em0 Graylog version is 4.0.8.

It seems enough retries and you’ll eventually get it to work. Here’s the regex that did it: (?i)^dhcpd\[\d+]:\s\w+\s(?:on|for|of|from)\s[0-9a-f.:]+\s(?:to|from)\s([0-9a-f.:]+)\s.+$ I did notice in one of my other ones I picked the wrong field; however, that wasn’t the case in my MAC address extrac…

Regex extractor not working

Graylog Central (peer support)

tyler.montney (Tyler Montney) July 6, 2021, 1:46am 5

What more information do you need? It feels like when I use non-capture groups, it fails.

RegEx Tools vs Graylog Matching - Graylog - Graylog Community this indicates to use a site that supports Java Regex.

Topic		Replies	Views
Update MAC address field with leading zeros Graylog Central (peer support)	7	1349	July 23, 2021
Unable to get some REGEX extractors working Graylog Central (peer support)	3	827	November 19, 2019
Extractor Regex No Match Graylog Central (peer support)	5	823	November 22, 2021
Extractor dont'works Graylog Central (peer support)	4	349	May 27, 2020
Regular expression + Json Extractor not working? Graylog Central (peer support)	4	1197	April 8, 2021

Regex extractor not working

Related topics