How to search Graylog with a partial Text match - graylog

The wildcards seem to only apply to non-string literals and text.
I want to match the text on a partial match.
Example:
source: org.*.application-* AND "*.pdf"
The wildcard works with the source param but not instead of my literal.
How can I use a wildcard inside a string to get back all that match that contains a log with
"XXXXXXXXXXXX.pdf"

Okay - it turns out you remove the quotes - Anytime you add quotes the whole word must match
so this turns out to be the equivalent of what I was asking for:
source: org.*.application-* AND *.pdf

Related

Is there a way to escape all the special characters in a url string parameter?

I need users to be able to pass a file path as a parameter of a get url (the file would not be uploaded and only the local file path is used for some security reasons). Now it's difficult for them to go and change all the backslashes to "%5". I was wondering if there is a way to force encoding of a part of the url. For example something as simple as putting it in double quotes, which doesn't work...
http://example.com/"c:\user\somone\somefile.txt"/dosomething
I ended up using pattern matching of rest routes at the server level. Something like this:
/example.com/*path/dosomething
So it would match any path even with slashes/backslashes. At last I do a decoding of the url to get rid of the escaped characters passed by browser for chars like space.
java.net.URLDecoder.decode(path, "UTF-8")

Regex - Match everything after second occurence

I have the following string:
"http://sprzedajemy.pl/http://soloch.sprzedajemy.pl/renault-scenic-i-grafitowy,10395187"
Now, I want to match everything after the second occurrence of "http://", which I tried like this without any success:
/(http:\/\/){2}(.+)/
What am I doing wrong?
You're quantifying the group http:// twice instead of skipping to the second occurence. Use this regular expression:
/^(?:http:\/\/(.+)){2}/
Here is a regex demo!
Try the below regex to match the string which was after just after to the second http://,
(?<=http:\/\/)(?:(?!http:\/\/).)*$
DEMO
If you want to capture the string then try the below,
(?<=http:\/\/)((?:(?!http:\/\/).)*)$
DEMO
http.*?http\:\/\/(.*)
This should do it.
See demo.
http://regex101.com/r/bZ9kJ0/1
(?!http.*?http.*)http\:\/\/(.*)
Use this to ignore https if its there in first position.

Regex to match nested show path

I'm trying to write a regex to match a show path of a nested resource. The path goes like this: /users/:user_id/products/:id - I have been unable to write a regex to check if a url is for this path. I don't want anything after the products/:id to pass the match. Right now I have the following:
/users/([^&]*)/products/
This works in that it'll match the url path I'm looking for, but I cant figure out how to end it after the /products/:id so it won't match actions such as /edit. So users/1-my-name-is-bob/products/1-awesome-product should match, but users/1-my-name-is-bob/products/1-awesome-product/edit should not match the regex.
try to use this pattern:
\/users\/([^&\/]+)\/products\/[^\/]+\Z
\Z stand for end-of-the-string
you can remove slashes at the begining if not needed, or make it optional with a question mark

Apostrophe issue in url with OData

I am using oData protocol which add the filter criteria in the url
E.g. /api/restaurants/getall?$filter=substringof('macdonald',Name)
My problem when the value has apostrophe like (macdonald's) it will break the url
It works fine if I replace it with %26 like macdonald%26 but by adding s (macdonald%26s) the url will not work
any suggestions?
When inside the quoted string a single quote can be escaped by doubling it. So in your case it would look like 'macdonald''s'.
I see this is an old post, but I'll point out that the arguments in the substringof expression are switched.
https://help.nintex.com/en-us/insight/OData/HE_CON_ODATAQueryCheatSheet.htm
This is aside from the apostrophe (single quote) problem.

Why is this query string invalid?

In my asp.net mvc page I create a link that renders as followed:
http://localhost:3035/Formula/OverView?colorId=349405&paintCode=744&name=BRILLANT%20SILVER&formulaId=570230
According to the W3C validator, this is not correct and it errors after the first ampersand. It complains about the & not being encoded and the entity &p not recognised etc.
AFAIK the & shouldn't be encoded because it is a separator for the key value pair.
For those who care: I send these pars as querystring and not as "/" seperated values because there is no decent way of passing on optional parameters that I know of.
To put all the bits together:
an anchor (<a>) tag's href attribute needs an encoded value
& encodes to &
to encode an '&' when it is part of your parameter's value, use %26
Wouldn't encoding the ampersand into & make it part of my parameter's value?
I need it to seperate the second variable from the first
Indeed, by encoding my href value, I do get rid of the errors. What I'm wondering now however is what to do if for example my colorId would be "123&456", where the ampersand is part of the value.
Since the separator has to be encoded, what to do with encoded ampersands. Do they need to be encoded twice so to speak?
So to get the url:
www.mySite.com/search?query=123&456&page=1
What should my href value be?
Also, I think I'm about the first person in the world to care about this.. go check the www and count the pages that get their query string validated in the W3C validator..
Entities which are part of the attributes should be encoded, generally. Thus you need & instead of just &
It works even if it doesn't validate because most browsers are very, very, very lenient in what to accept.
In addition, if you are outputting XHTML you have to encode every entity everywhere, not just inside the attributes.
All HTML attributes need to use character entities. You only don't need to change & into & within script blocks.
Whatever
Anywhere in an HTML document that you want an & to display directly next to something other than whitespace, you need to use the character entity &. If it is part of an attribute, the & will work as though it was an &. If the document is XHTML, you need to use character entities everywhere, even if you don't have something immediately next to the &. You can also use other character entities as part of attributes to treat them as though they were the actual characters.
If you want to use an ampersand as part of a URL in a way other than as a separator for parameters, you should use %26.
As an example...
Hello
Would send the user to http://localhost/Hello, with name=Bob and text=you & me "forever".
This is a slightly confusing concept to some people, I've found. When you put & in a HTML page, such as in <a href="abc?def=5&ghi=10">, the URL is actually abc?def=5&ghi=10. The HTML parser converts the entity to an ampersand.
Think of exactly the same as how you need to escape quotes in a string:
// though you define your string like this:
myString = "this is \"something\" you know?"
// the string is ACTUALLY: this is "something" you know?
// when you look at the HTML, you see:
<a href="foo?bar=1&baz=2">
// but the url is ACTUALLY: foo?bar=1&bar=2

Resources