Let's say I have these 2 events in my index:
04-06 15:56:03 This is another log line of text 654321
04-06 15:55:03 This is a log line of text 123456
I can simply enter index="test" log on the search bar and will see both events return, however, if I enter index="test" regex="log" in the search bar, it returns 0 events. This regex is valid PCRE. Entering index="test" regex=".*log.*" doesn't return any results either.
With regex="log"
you're actually performing a field search on the field regex. You probably want to use the regex command instead.
index=test | regex _raw="log"
With regex="log"
you're actually performing a field search on the field regex. You probably want to use the regex command instead.
index=test | regex _raw="log"
Or, when you just need basic wildcard matches, you can skip the regex processing altogether and use "log*" instead of the regex "log.*"