diff --git a/tools/sigma/backends/graylog.py b/tools/sigma/backends/graylog.py
index 615cca1b1..90f3ec725 100644
--- a/tools/sigma/backends/graylog.py
+++ b/tools/sigma/backends/graylog.py
@@ -23,5 +23,5 @@ class GraylogQuerystringBackend(ElasticsearchQuerystringBackend):
     active = True
     config_required = False
 
-    reEscape = re.compile("([+\\-!(){}\\[\\]^\"~:/]|(?<!\\\\)\\\\(?![*?\\\\])|&&|\\|\\|)")
+    reEscape = re.compile("([\s+\\-!(){}\\[\\]^\"~:/]|(?<!\\\\)\\\\(?![*?\\\\])|&&|\\|\\|)")
     listSeparator = " "