I need to filter Sumo Logic queries into success and failure stats, based on http status codes in the 200-300 ranges, and 400-500 ranges, respectively.

I’ve tried several regular expressions along these lines, which all return no rows:

 | where elb_status_code matches "2*|3*"
 | where elb_status_code matches "2.."
 | where elb_status_code matches "(2|3)*"
 | where elb_status_code matches "[23]*"

It seems that ., |, and [] do not actually work.

This one return the error: Invalid escape character; only \, ', ", b, f, n, r, t are allowed.

 | where elb_status_code matches "d*"

This one successfully returns a variety of 3xx codes like 301 and 302

 | where elb_status_code matches "3*"

This query returns both 200 and 302 rows:

 | where elb_status_code matches "*0*"

As far as I’ve found, * is the only regex symbol that matches recognizes. This does not sound like regex support at all…merely a wildcard match. And, it cannot fulfill my need of matching both 2xx and 3xx codes.

I feel like I’m probably missing something fundamental, as the docs for Sumo Logic’s matches operator are abundantly clear that it supports regular expressions:

https://help.sumologic.com/docs/search/search-query-language/search-operators/matches/

The matches operator can be used to match a string to a wildcard pattern or an RE2-compliant regex. 
...
Regex must be RE2-compliant. https://github.com/google/re2/wiki/Syntax

They show some examples of non-trivial regular expressions, such as:

| where ip matches /12.1[34][1-5].12.12[3-7]/

Do I need to “turn on” regex support somewhere? Is this an enterprise-level feature my employer doesn’t have?

This is the full Sumo query I’m using, with the where line swapped out for all the trials above:

_sourceCategory=alb/production and "account-123"
 | where elb_status_code matches "d*"

…

Lacking this regex support, this is the workaround another team has developed. I’m not above using it, but it won’t be long before this style solution will be unable to match the results of a simple regex.

| if (elb_status_code matches "2*", 1, if (elb_status_code matches "3*", 1, 0)) as successes