Stream rules with logical OR AND

Graylog Central (peer support)
,
1

I am trying to match regular expression with logical OR for value expression but it does not work.
Any ideas?

gray
gray.png700×700 32.5 KB

2

Hello OR is not a valid regex. Try (30|31)

See https://regex101.com/ to test the expressions

3

Thanks for answering
unfortunately (30|31) didn’t work

4

It seems that when i load a message id and test the rules it works but on realtime log streaming it does not work

5

I have a pipeline rule:

rule “split_timestamp”
when
true
then
let ts_second = $message.timestamp.secondOfMinute;
end

and then on stream rules i have message expression for field second (30|31)

on test it works but on realtime stream it does not.

6

what is your processing order? When you match a field in the stream rule that is created in the processing pipelines - that might run after the stream rules, it will not match.

You should use the pipeline routing or change the processing order.

7

Message Processors Configuration:

Pipeline Processor
Message Filter Chain
GeoIP Resolver

8

I stopped to battle against that. I’m doing the routing directly inside the pipeline, at least it’s clear where it’s done.

9

Ok thanks,
I follow your advice and i think i have done my job

10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.