Regex to find if a field exists

Graylog Central (peer support)
1

Hi All,

I am trying to write a pipeline rule in which I’ve to check if a field exists with a particular regex pattern. Is there any way I can do it? Usually, we use has_field() if when we know the exact key. In this case, we don’t. For e.g. I’ve to filter all the messages which have one of the following fields:
filesystem.asd
filesystem.add
filesystem.wer

I need to write something like:
rule “filesystem_new”
when
has_field(“filesystem.*”)

Please let me know how can this be done.

2

this is not possible.

You might want to create a future request over in github for that: https://github.com/Graylog2/graylog2-server/issues

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.