I’ve a log with field parsing value as : [content:tcpdi].
My rule stream match the content and send his log in this stream. But when I use the Field Content Alert Condition with field name: content and value “tcp*” (without quote), the alert condition didn’t match.
When I use “content:tcp*” (without quote) in search query field, it match. But when I see the details of alert condition, the translate alert query is ‘content:“tcp*”’ (without single quote). INdeed, when I try with this translate query in the search query field, he didn’t match.
Someone have a solution ?