Search by json field does not work

[nepster-web (Nepster)]

I was enable leading wildcard searches but it does not work with json fields.

I have field _params:

So, I try find: “click_id”: “62e698b4-2608-4cf3-8a07-5123c329fdb2”:

But this query does not work with json field. How can I do this?

[jan (Jan Doberstein)]

Graylog does not know about json in the search - so you would need to search different.

https://docs.graylog.org/en/3.1/pages/queries.html

_params:"62e698b4-2608-4cf3-8a07-5123c329fdb2"

The above should work but I’m not 100% sure because I do not have the data available.

I would - if you have that json in that and need to search regular on that fields - use a processing pipeline to make those key-value into their own fields.