Hi, Logical OR works for me with rc3 streams.
Create new stream, then add new stream rule. Select required field, where you want to search for strings. It could be either parsed field name, with strict values or it could be "message" (full event). Both work well for me. Select Type "match regular expression" Select Value: 172.22.71.4|172.25.58.17|192.168.167.71 Save rule. Don't forget to start/enable stream after you created it. Select "Resume the stream" from stream's action dropdown. regards, On Monday, February 17, 2014 6:00:34 PM UTC+2, Tim wrote: > > Although in v0.92 of graylog I was able to define values in a rule such > as... > > value1|value2 > > ...in order to create a logical OR (because all rules were ANDed), this no > longer seems to work in v0.20.0-rc.3 > > I have tried > > value1|value2 > > (value1|value2) > > ...but no joy. The rule always shows no match for either of value1 or > value2 > > Has the syntax changed ? > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
