Stream Rules doesn't work

(alban) #1


I create a stream for all switch logs.
I want to redirect all switch on this stream.
It is possible to create a rule condition for many source IP ?

Example : i have 2 ip for switch ( and
i try this but it’s doesn’t work


(alban) #2

nobody know ?
Nobody can help me

(John Buchanan) #3

I could be wrong but I don’t believe that’s a valid regex pattern. Might be simpler if you do 2 rules for the stream, Field=Source, Type=Match Exactly, Value= Second rule of course matching on Then for Step 2 of your stream rules ensure you have “A message must match at least one of the following rules” selected. If your switch might be logging from one or the other of those IP’s.

I know you can use operators such as AND or OR in a Pipeline rule, or a Lucene query, but not a regex pattern.

(alban) #4

Thank you.
It’s work fine.

(system) #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.