Wildcard Searching within Pipeline Rule

Graylog Central (peer support)
1

Hello Fellow GL enthusiasts!!

Trying to do a simple REGEX match on file names. I’m trying to pull out any file in the TargetFilename field that has a .aspx or .config or .cs or .php or .dll extension

Putting just .dll|.aspx doesn’t work

Here’s the syntax I tried, but it bombs out. Any insight is appreciated

rule “find message - Web Files”
when
regex("\\*.aspx|\\*.cs|\\*.config|\\*.php|\\*.dll", to_string($message.TargetFilename)).matches == true
then
end

2

You may want to try this one:

regex("\\.*\\.(aspx|cs|config|php|dll)$", to_string($message.TargetFileName))

3

Thanks…Just popped that in and tried it…no go…it doesn’t parse the file like web.config.

4

Are you sure that TargetFileName actually exists and contains the expected input? Other than that I have no idea why it wouldn’t work … :frowning:

5

I think I see the issue… TargetFilename is the name of the field…not TargetFileName… case sensitive

Trying again

6

Yup…that was it…the field is TargetFilename … so your regex was right…and my fieldname was right…so between us…it works! Thanks

TP