[graylog2] search wildcard in quotes

2015-01-26 Thread Maciej Strömich
Hi, can someone elaborate a bit on using wildcard searches inside double quotes in GL? We're running 0.92 and have a case where we need to search for an exact phrase with wildcard in the end and it doesn't work for us. e.g. something like message:"Missing assetId*" Maybe there's an option

Re: [graylog2] search wildcard in quotes

2015-01-28 Thread Edmundo Alvarez
Hello, As far as I know, it is not possible to use an exact phrase (a search term enclosed in quotation marks) with wildcards inside in Elasticsearch. The wildcard will be simply ignored. If you only want to check that your query matches both "Missing assetId" and "Missing assetIds", this is wh

Re: [graylog2] search wildcard in quotes

2015-01-28 Thread Maciej Strömich
This is not exactly true, or I'm misreading something in the elasticsearch docs. http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html "analyze_wildcard - By default, wildcards terms in a query string are not analyzed. By setting this value to t

Re: [graylog2] search wildcard in quotes

2015-01-28 Thread Edmundo Alvarez
I don't think that information is related to the issue you reported, at least if I understood it correctly. As far as I know, we always use query string queries for searching. Anyway, when you type the term assetId* (without quotes), your wildcard gets analysed correctly or it should in most ca

Re: [graylog2] search wildcard in quotes

2015-01-28 Thread Arie
Marciej, THis is exactly as I told you. For this type of query you have to specify a "default_field" AND your contend* search query. The default field could be the input of your messages for example, or any other field that is relied to your search. On Wednesday, January 28, 2015 at 1:24:36

Re: [graylog2] search wildcard in quotes

2015-01-28 Thread Maciej Strömich
Thanks for clarifications. I think I found a workaround for my issue: source:staging* AND message:(Missing AND assetId*) which is not "beautiful" but does it's job. Thanks for your time On Wednesday, January 28, 2015 at 1:45:37 PM UTC+1, Arie wrote: > > Marciej, > > > THis is exactly as I tol