Case sensitive search results

1. Describe your incident:

A search like:

namespace: foo\-bar AND message: \|ERROR\|

shows messages with both |ERROR|:

2022-12-14 08:56:53.247|ERROR| …

which is OK and expected.

and “error”:

[ … ] last error was Success […]

which should NOT show up at all. We only need the lines containing “|ERROR|”

2. Describe your environment:

  • OS Information: Ubuntu 20.04 LTS

  • Package Version: GL 4.3.9 + OpenSearch 1.3.6

  • Service logs, configurations, and environment variables:

Does not apply - I guess :slight_smile:

3. What steps have you already taken to try and solve the problem?

I read several pages where it’s stated that OpenSearch/ElasticSearch are case-insensitive:

which is nice if you want to use some JSON-base query. But the idea is to get case-sensitive results from the “search” field on Graylog.

4. How can the community help?

Can someone please clarify whether the Graylog searches are case-sensitive or not? If they are, how should I search to get only those lines where “|ERROR|” appears?



I see this come up here and Elasticsearch/Opensearch forum, This is a old post but I beieve it still holds true.

Hello @gsmith

Thanks for your answer.
I also found this Built-in analyzer reference | Elasticsearch Guide [7.10] | Elastic

So, if I understand it correctly:

a) I can change from
elasticsearch_analyzer = standard
elasticsearch_analyzer = whitespace
in /etc/graylog/server/server.conf and restart Graylog to apply changes. This way, search results won’t be lowercased.

b) This will only be true for newly created indices after the elasticsearch_analyzer has been changed but old indices won’t benefit from that change.

Is it possible to change the analyzer for an already defined index set?



I havent done this before but I would imagine from my other troubelshoot experences, try manually rotating/recalculate the index set from the Web UI. Not sure if it will work in your case.

Maybe change your search to look for |ERROR| regex style? It’s interesting that the search is not picking up the pipes and thereby finding the lowercase error.

namespace: foo\-bar AND message:/\|ERROR\|/

Alternatively you can parse out the ERROR into it’s own field ahead of time with an Extractor or in the pipeline…

1 Like

Hi @tmacgbay

it seems like using regexes to match lines with “|ERROR|” (w/o quotes) could be the way to go… however, I got the following results:

^.*(?=\|ERROR\|).*$ <- GL complains with wrong syntax

^.*\|ERROR\|.*$ <- GL complains with wrong syntax

^[-\d\ :.]+\|ERROR.+? <-- GL complains with wrong syntax

\d+\|ERROR\| <- OK, but lines with lowercase "error" are still shown

\|ERROR\| <- OK, but lines with lowercase "error" are still shown

Oddly enough, they do work perfectly well in

So I guess it has to do with the standard analyzer which is set by default… the problem is that it cannot be changed for the existing indices, neither from the GUI nor from the config file… or am I overseeing the obvious?



Yea, I forget message: field isn’t searchable like the rest:

If you are interested in the messages that contain “|ERROR|” over time it is best to break out the information with extractors and/or pipeline as the data comes in. :upside_down_face:


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.