Hi All,
I’ve just setup a new graylog server and am trying to create a new stream for our domain controller event logs. Our domain controllers have a specific format: eg: ENF-DC01.COMPANY. COM or AST-DC1.COMPANY. COM (we have 15 in total)
so i’ve created a new rule under a stream where source should match the regex:
.{4}(dc01 |DC01|dc1|DC1)(.company.com|.COMPANY. COM)
I’ve verified that this regex works using online generators and it also works if i search all messages using:
source: /.{4}(dc01 |DC01|dc1|DC1)(.company.com|.COMPANY. COM)/
But the stream just doesn’t seem to match any logs. When i load a message to test the rule it says:
“This message would not be routed to this stream”
I dont understand why the regex works in a search but not a stream.
Any help would be appreciated. Thanks