1

I am having an issue finding the proper query syntax to search for the following string in my graylog messages:

Example strings:

/path-one/12/status
/path-one/18/status
/path-one/103/status
/path-one/9821/status

These are in the request_url field.

I've tried the following:

request_url:"/path\-one/.+/status" => Returns No results
request_url:/path-one/.+/status => Malformed in the following location and points to "/path-one/"
request_url:/path\-one/.+/status => Malformed in the following location and points to "/path\-one/"
request_url:/path-one/[0-9]+/status => Malformed in the following location and points to "[0-9]"

What is the proper syntax to find the strings I want where the middle section can be a positive number?

NewGuy
  • 3,273
  • 7
  • 43
  • 61

1 Answers1

1

You could try

\/path-one\/[0-9]+\/status

See a demo on regex101.com.

Jan
  • 42,290
  • 8
  • 54
  • 79