Logfilter agent does not pick up the configured log entries (4256436)

Logfilter agent does not pick up the configured log entries. The expression on the include list is set to:

.*ERROR_[201-999].*   =>   CRITICAL

Log entries containing ERROR_200 should be excluded.

When writing regular expressions to catch a number, each single digit needs to be mentioned. The matching string needs to be set like this:

.*ERROR_[2-9][0-9][1-9].*    =>   CRITICAL

When using the exclude list a more general match can be created:

.*ERROR_[0-9][0-9][0-9].*   =>   CRITICAL

The exclude match list has to be set like this:

.*ERROR_[2][0][0].*   =>   CRITICAL

When using the exclude list make sure that related entries from both lists are having the same severity, in this example critical. This is related to the workflow when evaluating the list. Before evaluating the matching strings, they will be grouped by the severity so the evaluation order will be like this:

All fatals from exclude list

All fatals from include list

All criticals from exclude list

All criticals from include list

All warnings from exclude list

All warnings from include list

All informationals from exclude list

All informationals from include list