Case sensitive search results

[tmacgbay]

Yea, I forget message: field isn’t searchable like the rest:

Regex search in message field

Hello, because I couldn’t find any info in the documentation, is it possible to use regex search in the message field? Let’s assume we have a message field containing: This is number 8748343 just for testing purposes. Now I have tried all possible search syntax: message:/This is number .+ just for testing purposes./ message: /This is number .+ just for testing purposes./ message:/This is number .+ just for testing purposes.+/ /This is number .+ just for testing purposes.+/ /This\sis\snu…

If you are interested in the messages that contain “|ERROR|” over time it is best to break out the information with extractors and/or pipeline as the data comes in.