-
Title
Case Insensitive RegEx Filter -
Description
Filter statements are not matching the correct data within logs and thus the filters are failing. -
Cause
Logs are coming in with varying uppercase/lowercase characters and the filter statement is not matching correctly. -
Resolution
To use case-insensitive filter statements simply follow the Regular Expression for matching both an uppercase and/or lowercase character.
The RegEx for this is [Uppercase Character|Lowercase Character]. An example of this would be [A|a] or [G|g]. These two statements for the characters "A|a" and "G|g" match both the uppercase and lowercase of these characters.To use this in a filter statement see the below example as it demonstrates how to apply this in a filter:
match("[W|w][I|i][N|n][D|d][O|o][W|w][S|s] [M|m][A|a][C|c][H|h][I|i][N|n][E|e]" value("HOST"))
The above filter looks for "Windows Machine" as the HOST, however, Windows Machine can be written in any form of uppercase/lowercase and it will still match.
For example, the following would still match the filter statement: "WiNdOwS hOsT"
As one can see, the filter statement is case-insensitive and will match any form of the characters uppercase or lowercase.