Graylog Search returns strange results

Graylog Central (peer support)
1

Hi there,

i have a problem with my graylog search:
I have a field which contains the length of a Domain as a Number. If i do the following search over the past 5 minutes i do not get the result i was expecting.

DNS_DomainLength:>40

I want to get only messages where the Domain is longer then 40 Chars (which should be done with this query i guess), but i also get messages where the domain is less than 40. If i do this query: DNS_DomainLength:40 it works like it should.

I also tried it with range {}[] or with AND but it doesnt work. I also tried to convert it to int to see if it does make a difference (which should not cause of elasticsearch)

Greetings Merasil

2

Are you sure that the field is saved as Numeric?
Try plotting a line graph also on that field.

Does this return only rows with values between 40 and 50

DNS_DomainLength:[40 TO 50]

If things are not as expected, then most likely the index has that column as string.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.