The search query logic seems to have changed since upgrading to Graylog v3, ES v6.7 and now running into issues when trying to search for 2 different fields using
FieldA: Foo AND FieldB: Bar, the search returns results which do not match both of the fields.
This seems to happen when the extracted fields do not exist against all of log messages, and results do not contain one of the extracted fields in the search.
If you search for either of the fields on their own they return the correct results matching the search.
Can you please advise whether this is expected behaviour or a bug? If its expected, are there any settings I can change to modify this search behaviour?
Please let me know if you need any more information.