How string filters work

The contains and regex filters provide you with wildcard capabilities on both index string data and non-indexed string data. These filters have syntax requirements.

Use the contains and regex filters in any text or string field. The case insensitivity icon next to filter field names denotes text fields. Other fields that allow the contains filter do not have that icon.

Syntax Examples

Syntax for contains is contains(somevalue) and for regex is regex(someregularexpression).

To make the filters case insensitive, click or include the /i regular expression notation, as in regex(/somevalue/i). The search results return values that contain somevalue, regardless of case.

The NOT and icons apply to contains and regex values. To show the values in the search results without a value, enter the value and click the icon. If you want the results to show one value or another, enter the values and click .

Example #1 — A simple search

Indexed fields:	`contains(stra)`, `regex(stra)`
Non-indexed fields:	`stra`
Result:	Returns strings with `stra` , such as administrator, gmestrad, or straub.

Example #2 — An OR search

Indexed fields:	`contains(admin,NGCP)`, `regex((admin\|NGCP))`
Non-indexed fields:	`admin,NGCP`
Result:	Returns strings in the field that contain admin or NGCP. The regex OR requires the extra set of parentheses to function.

Example #3 — A search for special characters, such as in service accounts

A dollar sign:

Important
To make the filter work, you must use the ASCII code \x24 for a dollar sign.

Indexed fields:	`contains(\x24)`, `regex(\x24)`
Non-indexed fields:	`\x24`
Result:	Either statement returns strings in the field that contain a dollar sign

With regex, if you try to use the \x24 without scaling it, the result set returns empty. PCRE escape sequence is a better search method to use.

A percent sign:

Indexed fields:	`contains(%)`, `regex(\x25)`or `regex(\%)`
Non-indexed fields:	`%`

A backslash:

Indexed fields:	`contains(\)`, `regex(\x5c)` or `regex(\\)`
Non-indexed fields:	`\`

Dual back slashes

Indexed fields:	`contains(\\)`, `regex(\x5c\x5c)` or `regex(\\\)`
Non-indexed fields:	`\\`

Note
If you do not use the HEX value or the slash with regex, the Invalid Regular Expression (ER5-0015) error can occur.

Example #4 — Search using the * wildcard

Indexed fields:	`contains (ad*)`
Non-indexed fields:	`ad*`
Results:	Returns any string that starts with `ad`, such as administrator and address.

Example #5 — Search using Regular Expression

These domains are from Microsoft DNS events.

`regex(nitroguard\x28[3-4]\x29[com\|info}+)`
`(3)www(10)nitroguard(3)com(0)`
`(3)www(10)nitroguard(4)info(0)`
`(3)www(10)nitroguard(3)gov(0)`
`(3)www(10)nitroguard(3)edu(0)`
`(3)www(10)nitroguard(7)oddball(0)`
Results:	This regular expression picks out a specific string. In this case, its `nitroguard`, a 3- or 4-digit primary domain, and `com` or `info`. This regex matches the first 2 expressions but not the others. These are examples to show how regex can be used with the feature.

Caveats

To avoid higher overhead and slower query performance, use regex with values with a minimum of three characters.
This filter can't be used in correlation rules or alarms. The only exception is that it can be used in correlation rules with name/value custom types.
Using contains or regex with NOT can cause higher overhead and slower query performance.
Familiarity with bloom filters is recommended.