I wold like to create a dashboard widget by adding some search results. My goal is to search for message containing “connect from unknown” and excluding messages containing “123.123.123.*”.
I tried to do it with:
message:"connect from unknown" AND NOT message:"123.123.123.*"
But messages like “connect from unknown[184.108.40.206]” are still visible.
If I change the query to
message:"connect from unknown" AND NOT message:"220.127.116.11"
Then it works.
Note that I changed the graylog config file /etc/graylog/server/server.conf to allow_leading_wildcard_searches = true