Skip to main content

V2 query:

services.banner="{\"connect\":*foo\":*"

Converted V3 query:

host.services.banner=~"^\\{\"connect\":.*foo\":.*"

The response is “Your query is invalid”.

Hey vitutus, since you’re using double quotes there you’d need extra escapes for them. The valid syntax would be:

host.services.banner=~"^\\{\\\"connect\\\":.*foo\\\":.*"