Is it possible to use regular expression in filter ?

hi all,

I try to using regular expression in my rule as below, it’s will alert when id is 1.1 and msg contain type.24:6

 filter:
 - and:
    - term:
         id: "1.1"
   - query:
        query_string:
            query: "msg:\"Type.[0-9]{1,2}\\:6\""

but it’s cannot alert ,Is it possible to use regular expression in filter ?

Thanks by advance

[alankis]

@abhishekjiitr What about using complex queries like this one below:

filter:
- query:
    query_string:
      query: "beat.hostname: some.hostname  AND system.process.name: java AND system.process.cmdline: /*java*/ AND system.process.cmdline: /*org\.apache\.spark\.deploy\.master\.Master*/"
      analyze_wildcard: true

I am getting the same error ‘found unknown escape character’.

Edit: Each of reserved characters should be escaped. So the last line should look like this:

filter: 
- query:
    query_string:
      query: "system.process.cmdline: /*org/.apache/.spark/.deploy/.master/.Master/*"
      analyze_wildcard: true

[Qmando]

Is field analyzed? If so, you’ll definitely need field.raw or field.keyword. I would have tried option # 1 so if that doesn’t work I can’t help you.