Ask a Question
Back to All

Regex search on a specific field?


Hi all,

Is there a way to do a Regex filter on a specific field within Seq?

Theoretical example:

  • Let's say I have some URLs with a type of information in the URLs (for regex simplicity sake, let's say it's an SSN). SSNs in the URLs would be bad, so I want to find them so I can ensure we prioritize their removal in our app, which is a large codebase.
  • We use the Serilog.Web loggers to log the output of our requests. So I'd like to look for the type of information (SSN in this case) in the logged raw URL.

The search below would pick up on some of the SSNs in our example, but it searches the entire body of the message and thus is prone to false positive hits as well:

/\d{3}-?\d{2}-?\d{4}/ and @EventType = 0x5FF28D57

When I try to search on the RawUrl field though, the following search returns no results:

RawUrl = /\d{3}-?\d{2}-?\d{4}/ and @EventType = 0x5FF28D57

I also tried:

RawUrl = (/\d{3}-?\d{2}-?\d{4}/) and @EventType = 0x5FF28D57
RawUrl like /\d{3}-?\d{2}-?\d{4}/ and @EventType = 0x5FF28D57
RawUrl like (/\d{3}-?\d{2}-?\d{4}/) and @EventType = 0x5FF28D57

Is there a way to apply a regex filter or expression to a specific field within Seq?