Regex to find credentials in NLS

[apawar]

For string: ""keys\":{\"onlineID\":\"*****\",\"passcode\":\"*****\"}"
I have created regex onlineId\":"[\w+]{1,12} for finding online ID & password, it is working fine over code writer & text parsing tool, but when I tried it on NLS it is not working as expected, NLS just shows me blank page.

It supposed to be trigger when there is userdata inplace of "*"(asterisk)

Can someone help me on this to create regex on NLS ???

[npolovenko]

Hello, @apawar. The problem is that elasticsearch doesn't store the whole string combined, but instead it separates each word into its own keyword. So the regex filter for onlineID + "some string" won't be able to find any matches.
https://www.elastic.co/guide/en/elastic ... lyzer.html

Let's try the following workaround using Log Server filters. Find one of the onlineid events on the dashboard and click on magnifying glass to create a new filter out of the onlineID\":\"*****\",\"passcode\":\"*****\" message.

Untitled2.png

Then find the newly created filter and change the query to:

"keys\":{\"onlineID\":"*", \"passcode\":"*"}"

Untitled.png

Let me know if this works for you.