Glob syntax

Glob patterns specify sets of filenames with wildcard characters. The most common wildcards are *, ?, and [ ... ]. You can negate any pattern by prefixing it with a !.

Palo Alto Networks Cortex XCOR glob syntax doesn’t support using two asterisks where one of them is in the middle of a string. For example, *k8s*staging isn’t valid.

Regular expression syntax and glob syntax are not interchangeable. Cortex XCOR supports only one of these query matching patterns in supported areas of the product. For example, drop rules support glob syntax, whereas recording rules support regular expression syntax.

Wildcard	Description	Example	Matches	Doesn’t match
`*`	Matches any number of any characters, including none.	`Law\` `\Law\` `L\aw`	`Law`, `Laws`, or `Lawyer` `Law`, `GrokLaw`, or `Lawyer` `Law` or `Laaw`	`GrokLaw`, `La`, or `aw` `La` or `aw` `La` or `Laws`
`?`	Matches any single character.	`?at`	`Cat`, `cat`, `Bat`, or `bat`	`at`
`[abc]`	Matches one character given in the bracket.	`\[CB]at`	`Cat` or `Bat`	`cat`, `bat`, or `CBat`
`[a-z]`	Matches one character from the (locale-dependent) range given in the bracket.	`Letter\[0-9]`	`Letter0`, `Letter1`, `Letter2`, up to `Letter9`	`Letters`, `Letter`, or `Letter10`
`{a,b}`	Matches one word given in the braces.	`\{pass,word}`	`pass`, `word`	`password`, `passing`

Table sourced from Wikipedia. For more pattern matching specifics, see the Glob primer.

Cortex XCOR

Palo Alto Networks Telemetry Pipeline

More information