I can't search numeric on message

Graylog Central (peer support)
1

I try to search by

(source:10.0.1.*) AND message:"“latency”:"<80000000

but I can’t see latency result less that 80,000,000

This is example message
message

2

how is the latency saved in Elasticsearch? if that is saved as a string such a query is not possible.

Currently the only option to know that is to get the current mapping ( http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings ) and see what field type is used for the field. If you only save numbers in the field latency then change the mapping of that field to number.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.