I wold like to create a dashboard widget by adding some search results. My goal is to search for message containing “connect from unknown” and excluding messages containing “123.123.123.*”.
I tried to do it with:
message:"connect from unknown" AND NOT message:"123.123.123.*"
But messages like “connect from unknown[22.214.171.124]” are still visible.
If I change the query to
message:"connect from unknown" AND NOT message:"126.96.36.199"
Then it works.
Note that I changed the graylog config file /etc/graylog/server/server.conf to allow_leading_wildcard_searches = true