Hello, As far as I know, it is not possible to use an exact phrase (a search term enclosed in quotation marks) with wildcards inside in Elasticsearch. The wildcard will be simply ignored. If you only want to check that your query matches both "Missing assetId" and "Missing assetIds", this is what I would do:
message:"Missing assetId" OR message:"Missing assetIds" I hope that helps. Regards, Edmundo -- Developer Tel.: +49 (0)40 609 452 077 Mobile: +49 (0)171 27 22 181 Mobile (US): +1 (713) 321 8126 Fax.: +49 (0)40 609 452 078 TORCH GmbH Steckelhörn 11 20457 Hamburg Germany https://www.torch.sh/ Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 Geschäftsführer: Lennart Koopmann (CEO) > On 28 Jan 2015, at 11:41, Arie <satyava...@gmail.com> wrote: > > An the second option I gave, does that work? > > We experience exactly the same thing. > > > > On Tuesday, January 27, 2015 at 2:37:50 PM UTC+1, Maciej Strömich wrote: > > Hi, > > I know that allow_leading_wildcard_searches and it's used to search for > terms like *something, and I know that it can cause increased memory > consumption. > > My question is strictly connected to the query language. > > when we query for > > "Missing assetIds" > "Misssing assetIds*" > > the results are found > > but when we do a search for > > "Missing assetId*" > > there are no results found which is kind of strange because following the > docs you could assume that this should search for all occurrences of Missing > assetIds. > > Maybe we're missing something that's why I've asked about the options part :) > > > On Monday, January 26, 2015 at 10:55:47 PM UTC+1, Arie wrote: > Hi, > > such a parameter exist in graylog2.conf, but don't know if it is wise to use. > > allow_leading_wildcard_searches = false > > If we are using such searches and it is within an know source or other > qualified field > we use # source:<hostname> "last acc*" > > hth,, > Arie. > > On Monday, January 26, 2015 at 5:28:02 PM UTC+1, Maciej Strömich wrote: > Hi, > > can someone elaborate a bit on using wildcard searches inside double quotes > in GL? > > We're running 0.92 and have a case where we need to search for an exact > phrase with wildcard in the end and it doesn't work for us. > > e.g. something like message:"Missing assetId*" > > Maybe there's an option in graylog2-server conf which needs to be turned on > like allow_leading_wildcard_searches? > > Digging a bit through a group I found only > https://groups.google.com/forum/#!searchin/graylog2/wildcard/graylog2/4IQubA243-A/BCnBpW78wQkJ > which can be somehow connected with our issue > > thanks. > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to graylog2+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
