From 7fca08e5bdef385951077a65d1f81bb821004d66 Mon Sep 17 00:00:00 2001
From: Cian Mc Govern <cian@cianmcgovern.com>
Date: Fri, 2 Jul 2021 21:56:08 +0100
Subject: [PATCH] Escape spaces in graylog backend

---
 tools/sigma/backends/graylog.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/sigma/backends/graylog.py b/tools/sigma/backends/graylog.py
index 615cca1b..90f3ec72 100644
--- a/tools/sigma/backends/graylog.py
+++ b/tools/sigma/backends/graylog.py
@@ -23,5 +23,5 @@ class GraylogQuerystringBackend(ElasticsearchQuerystringBackend):
     active = True
     config_required = False
 
-    reEscape = re.compile("([+\\-!(){}\\[\\]^\"~:/]|(?<!\\\\)\\\\(?![*?\\\\])|&&|\\|\\|)")
+    reEscape = re.compile("([\s+\\-!(){}\\[\\]^\"~:/]|(?<!\\\\)\\\\(?![*?\\\\])|&&|\\|\\|)")
     listSeparator = " "