Multiple filter in query

Hello @sohailmeer:

message: “ERROR|FAILED|WARN” is searching for that literal string in the body. Is that what you want? If not, then I think what you want is grouping.

source:“xyz” AND log_file_path:"/var/log/messages" AND (message:“ERROR” OR message:“FAILED” OR message:“WARN”)

https://docs.graylog.org/en/3.3/pages/searching/query_language.html

1 Like