Graylog2 / Graylog2/graylog2-server
Problem with Events in French
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Stange problem when I try to use regex in Extractor
I have 2 servers where I want to monitor Remote Desktop connections.
Server with **English language** works fine, full_message event come like this:
Remote Desktop Services: User authentication succeeded: User: REALM\username.name Domain: REALM Network Address: X.X.X.X
**With French Language:**
Services Bureau à distance : Ouverture de session réussie : Utilisateur : REALM\surname.name Domain: REALM Adresse réseau source : X.X.X.X
## Current Behavior
I try to extract the field USER, no problem in English but it seems that in French, the supposed space in full_message aren't really space character.
I already tried to use some convert function but without success.
## Steps to Reproduce (for bugs)
1. Try to extract $full_message of EventID 1149 in Windows Server 2012 R2 French
2. Extractor is in English : User: (\w+(\.\w+)?)
3. Extractor is in French : Utilisateur : (\w+(\.\w+)?) --> doesn't work
* Graylog Version: Latest VMWare OVA in your site
* Elasticsearch Version:
* MongoDB Version:
* Operating System:
* Browser version:
Contributor guide
Assessment
This issue has not been assessed yet.