Maciek, a regex match for a field value is not possible at the moment, sorry.
Bernd On 20 February 2015 at 16:13, Arie <[email protected]> wrote: > At leas in 09.3 you can > > Create a stream rule, and the first possibility on top is the field, > after that select regex > and in that you put (cvp) > > > > > On Friday, February 20, 2015 at 3:51:51 PM UTC+1, Maciej Strömich wrote: >> >> Hi, >> >> >> I'm trying to create a stream which will catch log entries containging >> "cvp" string. It's not a problem if there's only one field which needs to be >> checked. I've several places where this value can be found and I'm wondering >> is it possible to use a regex inside a "Field" input. AFAIK seperate stream >> rules will use AND and not OR to match messages. >> >> I've tried so far: >> >> (?:url|message) >> [url|message] >> url||message >> >> Is this even possible? >> >> br, >> Maciek > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- Developer Tel.: +49 (0)40 609 452 077 Fax.: +49 (0)40 609 452 078 TORCH GmbH - A Graylog company Steckelhörn 11 20457 Hamburg Germany Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 Geschäftsführer: Lennart Koopmann (CEO) -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
