Search issue with double colons

[intpdm (Andrey)]

Hi.

Are there any restrictions on searching in graylog?
Because i tried to find message with text having double colons ( :: ) and not get any results, but if i look by timestamp i can see it.
There is no errors in graylog or elasticsearch logs.

Environment:

elasticsearch-oss | 7.10.2
graylog-server | 4.3.8-1
mongodb-org-server | 4.4.27
Debian 10

Test message added from GELF:

echo -e ‘{“short_message”:“testing text::WITHDOUBLE.COLONS graylog”}\0’ | nc -w 1 <server_ip> 12201

How i can search word after the :: ?

[Joel_Duffield]

My guess is that because the message field is an indexed field it ignores the puncuation (the tldr is that it breaks aparts all the words, but punctuation spacing etc is ignored.

If you wanted to search it you would need to copy the message field into another field that was set to the datatype of keyword and then you should be able to find it in that.

[intpdm (Andrey)]

Thanks for answer.
Regex doesn’t work for the same reason, right?

[Joel_Duffield]

Correct, what you can do on that field though is all the “googly search things” like words not in order etc.