Search problem on custom fields

Graylog Central (peer support)
1

Hi,

I noticed that wildcard searches ( * ?) are not working in custom fields. For example if i have:

log_message:
Quotation catalog request for D82C6F351B6C5F2775E82DCD872592D70322EB9ECC0D7E4D7B8C75ED38774F95 998871675 2005302388685 - v01854599770

i can find result if my search query is:
log_message:“Quotation catalog request for D82C6F351B6C5F2775E82DCD872592D70322EB9ECC0D7E4D7B8C75ED38774F95 998871675 2005302388685 - v01854599770”

but i cannot find anything if the query is:
log_message:“Quotation catalog*”

pratically if there are spaces inside the fileds i can search only with full field content (not much usefull).

what am i doing wrong ?

2

Hej @guido

you need to create a custom mapping that adds analyze to the field where you want to be able to do wildcard searches.

regards
Jan