Double quotes within double quotes in search query

Graylog Central (peer support)
1

Hello all,

Complete newbie to Graylog so apologies if this is an easy one, I’ve searched for the answer but can’t find what I’m looking for.

I have a log entry as follows -

“foo”:“123”,“bar”:“456”

Sometimes there are no results in foo or bar, and the entry looks like this -

“foo”:"",“bar”:""

I want to search for these no result log entries, however all my search attempts show all the results with entries. I’ve tried the following by simply adding double quotes around the log entry -

““foo”:”",“bar”:"""

But that gives me all results with entries. I’ve also tried -

““foo”:”",“bar”:""

Which fails, so is probably completely wrong!

Is anyone able point me in the right direction?

Thanks in advance!

2

I do believe that the backslash \ is the preferred escape character. So you could try: \"

3

Have you tried the doc?
http://docs.graylog.org/en/2.5/pages/queries.html

4

Apologies, I did try with backslashes, however my original attempt must have been wrong as it seems to work now with the following -

“\“foo\”:\”",\“bar\”:""

Thanks for the help!

1 Like
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.