What’s the best way to add a filter for hosts where I only know that they are going to contain a certain string, but not know if the case, or if they are FQ? _raw.match?

Technical Question
,
#1

What’s the best way to add a filter for hosts where I only know that they are going to contain a certain string, but not know if the case, or if they are FQ? _raw.match?

Syslog data routing using match()
#3

_raw: /regexstring/igm.test(_raw)
host: /regexstring/igm.test(host)

3 UpGoats
#4

You can use the Javascript .match method, but a quicker more specific way is to use the .test method.

Example 1

Field: host
Value to look for: foo
Using .match:
host.match(/foo/i)!=null

Using .test:
/foo/i.test(host)

Example 2

Field: _raw
Value to look for: bar
Using .match:
_raw.match(/bar/i)!=null

Using .test:
/bar/i.test(_raw)

3 UpGoats