Wildcard in field value alert

Graylog Central (peer support)
1

HI,

I’ve a log with field parsing value as : [content:tcpdi].

My rule stream match the content and send his log in this stream. But when I use the Field Content Alert Condition with field name: content and value “tcp*” (without quote), the alert condition didn’t match.

When I use “content:tcp*” (without quote) in search query field, it match. But when I see the details of alert condition, the translate alert query is ‘content:“tcp*”’ (without single quote). INdeed, when I try with this translate query in the search query field, he didn’t match.

Someone have a solution ?

Thanks

2

check another field with wildcard search, after check your default Elasticsearch template for your filed and the working file also
maybe you can’t use wildcard on not analyzed fields.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.