I’m trying to define some alert which condition will check if the message contain any exceptions. But when I try to do the search with query message:“Exception” it would only filter the message contain the word “Exception” alone.
Some messages which contain some messages like the “NullPointException” will not be included.
Do we have any way to filter the message contain some words or end with some words?
If you want to include matches like NullPointerException you have to allow leading wildcard searches in your Graylog configuration file and search for *Exception.
thanks for your feedback, the wildcard finally works for me. That block me to define the alert notification. When using the wildcard in the alert, it will add the quote mark for the content.