Regex works in search but not in Stream

[another_user]

Hello,

I found a similar post about this topic, but in that case the solution was to escape the periods in the server name. My problem is slightly different in that my server names don’t have any periods.

I have two servers:

abc-servername
DEF12-ServerName

When I use this search it returns results:

source:/.*(servername|ServerName)/

However, when I put either /.(servername|ServerName)/ or .(servername|ServerName) into the stream rule it does not process any messages. What am I doing wrong with my syntax.

Thank you in advance for any help that you can provide.

[tmacgbay]

It would be helpful to post your stream rule, using forum tools above ( like: </> ) so that they are readable by the masses.

Without seeing the actual code, my first guess is that you are not escaping the “-” in abc-servername

[another_user]

Hi tmacgbay,

I’m not really sure what to post. I’ve set the stream up to match this rule.

source: must match regular expression .*(servername|ServerName)

I don’t currently have the “-” in the regex statement at all. I figured it would get included with .* as any character. I will try putting it in there escaped.

Thank you.

[tmacgbay]

I had in my head you were talking about a pipeline rule and misread the whole thing!

What is your Message Processor Configuration look like under system/configurations?

[another_user]

This is my configuration. I’m pretty new to this, so I haven’t changed a whole lot related to settings.

Thank you.

[tmacgbay]

Make sure in the stream rule that you have not put in the “:” for the field, that would mess it up. it is just the field name.