Graylog2 / Graylog2/graylog2-server

Problem with Events in French

Open
#3,893 13 comments 0 reactions 0 assignees View on GitHub
processing to-verify triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Stange problem when I try to use regex in Extractor

I have 2 servers where I want to monitor Remote Desktop connections.

Server with **English language** works fine, full_message event come like this:

Remote Desktop Services: User authentication succeeded: User: REALM\username.name Domain: REALM Network Address: X.X.X.X

**With French Language:**

Services Bureau à distance : Ouverture de session réussie : Utilisateur : REALM\surname.name Domain: REALM Adresse réseau source : X.X.X.X

## Current Behavior
I try to extract the field USER, no problem in English but it seems that in French, the supposed space in full_message aren't really space character.

I already tried to use some convert function but without success.

## Steps to Reproduce (for bugs)
1. Try to extract $full_message of EventID 1149 in Windows Server 2012 R2 French
2. Extractor is in English : User: (\w+(\.\w+)?)
3. Extractor is in French : Utilisateur : (\w+(\.\w+)?) --> doesn't work

* Graylog Version: Latest VMWare OVA in your site
* Elasticsearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.