a) I can change from elasticsearch_analyzer = standard
to elasticsearch_analyzer = whitespace
in /etc/graylog/server/server.conf and restart Graylog to apply changes. This way, search results won’t be lowercased.
b) This will only be true for newly created indices after the elasticsearch_analyzer has been changed but old indices won’t benefit from that change.
it seems like using regexes to match lines with “|ERROR|” (w/o quotes) could be the way to go… however, I got the following results:
^.*(?=\|ERROR\|).*$ <- GL complains with wrong syntax
^.*\|ERROR\|.*$ <- GL complains with wrong syntax
^[-\d\ :.]+\|ERROR.+? <-- GL complains with wrong syntax
\d+\|ERROR\| <- OK, but lines with lowercase "error" are still shown
\|ERROR\| <- OK, but lines with lowercase "error" are still shown
So I guess it has to do with the standard analyzer which is set by default… the problem is that it cannot be changed for the existing indices, neither from the GUI nor from the config file… or am I overseeing the obvious?