Wildcard in field value alert


I’ve a log with field parsing value as : [content:tcpdi].

My rule stream match the content and send his log in this stream. But when I use the Field Content Alert Condition with field name: content and value “tcp*” (without quote), the alert condition didn’t match.

When I use “content:tcp*” (without quote) in search query field, it match. But when I see the details of alert condition, the translate alert query is ‘content:“tcp*”’ (without single quote). INdeed, when I try with this translate query in the search query field, he didn’t match.

Someone have a solution ?


check another field with wildcard search, after check your default Elasticsearch template for your filed and the working file also
maybe you can’t use wildcard on not analyzed fields.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.