Fingerprint rule: two rules with the same fingerprint

On-Premise
1

Is it possible to have two or more custom fingeprint rules with the same fingerprint? I tried following example and it doesnt work.

message:"*[Exception]: Status of file * could not be checked*" → my-custom-fingeprint, title=“My title”
message:"*[FileNotFoundException] some exception text* → my-custom-fingeprint, title=“My title”

Update: simple answer yes, you can have multiple rules pointing to the same fingerprint. My problem is that my fingerprint rule isn’t beeing applied. I’ve tested it in Discover query and it filters events as it should.

2

I think Discovery is automatically escaping special characters but the function used at ingest does not. Here are my working example:

message:"*[[]Exception[]]: Status of file * could not be checked*"
message:"*[[]FileNotFoundException[]] some exception text*

I’m running on-premise 20.12.1

3

Pinging @jauer and @mitsuhiko who has a lot more context. Also ping @untitaker