# Search string for timestamp containing message field **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [February 13, 2023, 7:37pm UTC](https://community.graylog.org/t/search-string-for-timestamp-containing-message-field/27704 "2023-02-13T19:37:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![pavljiks](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/pavljiks/32/14232_2.png) [@pavljiks](https://community.graylog.org/u/pavljiks)\ **Post date:** [February 13, 2023, 7:37pm UTC](https://community.graylog.org/t/search-string-for-timestamp-containing-message-field/27704/1 "2023-02-13T19:37:58Z")
**1. Describe your incident:** I understand that it’s not desired way to use such tool and analyze data would be more proper. But at this point i need to get something to count of error messages on php\_error. These files i ship using rsyslog so multi-line log records transfer into separate lines in log files. And i need to get some kind of metrics on uniq records. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/487ab93a6547d51df9dd4ba0da5bd1ea066645b2.png) **2. Describe your environment:** - OS Information: Debian 11 - Package Version: 4.3.12 - Service logs, configurations, and environment variables: Docker-compose based installation **3. What steps have you already taken to try and solve the problem?** Tried a lot of queries but either selects too much or not selecting anything. **4. How can the community help?** Please help me to write query for both timestamps on message field. ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [February 13, 2023, 9:58pm UTC](https://community.graylog.org/t/search-string-for-timestamp-containing-message-field/27704/2 "2023-02-13T21:58:49Z")
This regex will match either one of the date formats you ```auto (\d{4}\-(0[1-9]|1[012])\-(0[1-9]|[12][0-9]|3[01]))|(\d{2}\-([Jj]an|[Ff]eb|[Mm]ar|[Aa]pr|[Mm]ay|[Jj]un|[Jj]ul|[Aa]ug|[Ss]ep|[Oo]ct|[Nn]ov|[Dd]ec)\-\d{4}) ``` here it is [in action](https://regex101.com/r/Al5uS9/1) Thats a start let me know if you need more detail. ---
**Author:** ![pavljiks](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/pavljiks/32/14232_2.png) [@pavljiks](https://community.graylog.org/u/pavljiks)\ **Post date:** [February 14, 2023, 9:25am UTC](https://community.graylog.org/t/search-string-for-timestamp-containing-message-field/27704/3 "2023-02-14T09:25:34Z")
Just last step. I need to add this to my search query (like additional **grep** ) So my _golden_ plan was to add this regex to query on message filed (complete message line): ```auto (application_name:php_error) AND message:(\d{4}\-(0[1-9]|1[012])\-(0[1-9]|[12][0-9]|3[01]))|(\d{2}\-([Jj]an|[Ff]eb|[Mm]ar|[Aa]pr|[Mm]ay|[Jj]un|[Jj]ul|[Aa]ug|[Ss]ep|[Oo]ct|[Nn]ov|[Dd]ec)\-\d{4}) ``` But sadly : **Query parsing error** : Cannot parse query * * * Then tried regex slashes but no result in both cases. ```auto (application_name:php_error) AND message:/(\d{4}\-(0[1-9]|1[012])\-(0[1-9]|[12][0-9]|3[01]))|(\d{2}\-([Jj]an|[Ff]eb|[Mm]ar|[Aa]pr|[Mm]ay|[Jj]un|[Jj]ul|[Aa]ug|[Ss]ep|[Oo]ct|[Nn]ov|[Dd]ec)\-\d{4})/ ``` OR ```auto (application_name:php_error) AND message:/.*(\d{4}\-(0[1-9]|1[012])\-(0[1-9]|[12][0-9]|3[01]))|(\d{2}\-([Jj]an|[Ff]eb|[Mm]ar|[Aa]pr|[Mm]ay|[Jj]un|[Jj]ul|[Aa]ug|[Ss]ep|[Oo]ct|[Nn]ov|[Dd]ec)\-\d{4}).*/ ``` As i said i am need regex as something like _grep_ on search output. ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [February 14, 2023, 2:40pm UTC](https://community.graylog.org/t/search-string-for-timestamp-containing-message-field/27704/4 "2023-02-14T14:40:48Z")
Ah! I didn’t read that you are going after the contents of `message:`… `message`, `full_message`, and `source` are analyzed but not indexed. Technically the best way to get what you are looking for is to parse them into fields as the message comes in so they are indexed properly. Not always optimal but that is generally how Graylog was set up. Detail on that about half way down on [this Docs page](https://go2docs.graylog.org/4-x/making_sense_of_your_log_data/writing_search_queries.html). You can search in message, it just doesn’t work the way others do. In old posts it there are mentions of implicit `^` and `$` in the search which would mean you would have to take into account the entire data of `message:` field when you search. Whenever I play with, I always come out feeling like I am not sure why it worked and that it was not optimized… ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [February 14, 2023, 11:42pm UTC](https://community.graylog.org/t/search-string-for-timestamp-containing-message-field/27704/5 "2023-02-14T23:42:19Z")
Hey @pavljiks You mentioned your using Rsyslog, by chance can you use a different log shipper like Filebeat /w multiline messages configuration? ---
**Author:** ![pavljiks](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/pavljiks/32/14232_2.png) [@pavljiks](https://community.graylog.org/u/pavljiks)\ **Post date:** [February 15, 2023, 7:41am UTC](https://community.graylog.org/t/search-string-for-timestamp-containing-message-field/27704/7 "2023-02-15T07:41:58Z")
yes it could be a solution. With rsyslog or syslog in general the best part that it is shipped with any linux distro/version. And can be quickly setup for remote log shipping. ---
**Author:** ![pavljiks](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/pavljiks/32/14232_2.png) [@pavljiks](https://community.graylog.org/u/pavljiks)\ **Post date:** [February 15, 2023, 7:57am UTC](https://community.graylog.org/t/search-string-for-timestamp-containing-message-field/27704/8 "2023-02-15T07:57:52Z")
> [@tmacgbay](#): > > Ah! I didn’t read that you are going after the contents of `message:`… `message`, `full_message`, and `source` are analyzed but not indexed. Technically the best way to get what you are looking for is to parse them into fields as the message comes in so they are indexed properly. Not always optimal but that is generally how Graylog was set up. Detail on that about half way down on [this Docs page](https://go2docs.graylog.org/4-x/making_sense_of_your_log_data/writing_search_queries.html). Parsing would be not that easy. Becouse php versions and programmers decide multiple ways how to use php.error files. So structure of those messages maybe completely different. At this point i will stick with search query like: ```auto AND (message:"UTC]" OR message:"Europe/Helsinki]" OR message:ERROR|CRIT) ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [March 1, 2023, 7:58am UTC](https://community.graylog.org/t/search-string-for-timestamp-containing-message-field/27704/9 "2023-03-01T07:58:20Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.