How to exclude using regex?

Troubleshooting
1

Hi,
How can I exclude e.g. a host using regex? I’m working on a event rule where I want to exclude specific hosts. I tried regex in the “Match Host” field like .*(?!pattern).* but it doesn’t seem to work. Does anybody know how to do it?

Thanks

2

Albeit there are ways to create a regex that matches lines that do not contain a certain string, I wouldn’t recommend that because it is cumbersome and not exactly easy to understand.

I would go with two rules: One that matches your hosts and does what you want and another rule before that one that says “stop processing” if the hostname matches some pattern:

image
image715×577 46 KB

Here the order is important: the “skip” rule must come first, followed by the rule which actually does something:

image
image1093×128 14.6 KB

2 Likes
3

Hi.
Did you try this one: ^(?!pattern)$
If you like to negate more than one: ^(?!pattern1|pattern2|…)$

Regards,
Christian

2 Likes
4

Apparently not, that worked. Thanks

5

Thanks for the suggestion, that would probably also work