Regular expressions

Important

Certain regular expression types are not supported in Helix Enterprise rules as of TQL 3.0. For a list of these types, see Version 3.0 Updates .

Helix search uses OpenSearch which has its own syntax. Some regular expressions may behave differently than expected, or not be supported. For more information, see the reserved characters and standard regular expression operators sections from the OpenSearch documentation, and the query parser syntax section of the Apache documentation.

Do not use regular expressions to search raw fields like rawmsg. Use a parsed field that contains the value you are looking for. For example, if the event has the msg parsed field and contains the string values you're looking for, use the following regular expression query:

msg:"/.(ModuleVersion)./"

Rule TQL supports most Perl Compatible regular expressions; however, anchors must be explicit for the beginning and end of line matches. If explicit anchors are not defined in a rules query, then Rule TQL will instead perform a substring match for the term.

For example, to match a uri field of “index.php”, the regular expression must be formatted as:

  uri:/index\.php\?/.

Additionally, you can use the caret symbol ( ^ ) to search fields at the beginning of a rule and use the dollar sign ( $ ) to search fields at the end of a rule. For example, if you want to look for index.php at the beginning of a field in a rule, you should use:

  uri:/^index\.php/

Any characters may be used, but certain characters are reserved and must be escaped. The reserved characters are:

. ? + | { } [ ] ( ) " \

Any reserved character (including a backslash) can be escaped with a backslash (for example, "\+").

Any characters (except double quotes) are interpreted literally when surrounded by double quotes.

Note

In regular expressions, do not enclose strings with single or double quotation marks.

A period “.” can be used to represent any character.

The plus sign "+" can be used to repeat the preceding shortest pattern one or more times.

The question mark "?" makes the preceding shortest pattern optional. It matches zero or one times.

Curly brackets "{}" can be used to specify a minimum and (optionally) a maximum number of times the preceding shortest pattern can repeat. The allowed forms are:

Parentheses "()" can be used to form subpatterns.

The pipe symbol "|" acts as an OR operator. The match will succeed if the pattern on either the left-hand side OR the right-hand side matches. The alternation applies to the longest pattern, not the shortest.

Ranges of potential characters may be represented as character classes by enclosing them in square brackets "[]". A leading ^ negates the character class. The allowed forms are:

Note that the dash "-" indicates a range of characters, unless it is the first character or if it is escaped with a backslash.

Note

For more documentation and examples of regular expression use cases, see the GNU documentation.