Multiple filter in query

Graylog
#1

Hi,

I am using this product for 2 or 3 months from now and it is amazing few of the things are very smooth and going if you have good understanding with the logs nature. I’ve been searching for an option and trying to achieve a thing i don’t know if it is possible. I want to get the multi syntax result.

for example when we set an search filter in linux log file
cat /var/log/messages |grep Jun\ 26 |grep -E “ERROR|FAILED|WAR” we get the result what we actually seeking for i am trying same thing for Graylog as well if hit the query like

source:“xyz” AND log_file_path:"/var/log/messages" AND message:“ERROR|FAILED|WARN”

This is just an example draw it wont work, i know to get the message we have to put AND between filters. So is there anyway we can put all the filters in one?

#2

Hello @sohailmeer:

message: “ERROR|FAILED|WARN” is searching for that literal string in the body. Is that what you want? If not, then I think what you want is grouping.

source:“xyz” AND log_file_path:"/var/log/messages" AND (message:“ERROR” OR message:“FAILED” OR message:“WARN”)

https://docs.graylog.org/en/3.3/pages/searching/query_language.html