Trying to construct a rule to match [cb/sl]-srv-[1-#]
rule "identify servers"
when
has_field("source") AND to_bool(regex(("/\b(cb|sl)-srv-cas\\d*\b/ gmi"),
to_string($message.source)).matches == true)
end
I have checked the regex part, which works, but having trouble with the syntaxt I think.
Advice welcome
Hi ,
Try this
\[cb\/sl]\-srv\-\[[\d+]\-\#\]
Tested http://grokconstructor.appspot.com/do/match#result working fine
jan
(Jan Doberstein)
3
you need to escape / and \ in regex - and possible double escape to make this work
system
(system)
Closed
4
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
