Searching question

Graylog Central (peer support)
1

Have a quick search question. Having trouble matching anything with a wildcard after a specific string in a field. Here is an example that works.

cs-host:nmvtis.ssy.local AND cs-uri-stem:\/api\/vin\/VHR\/99999999\/2D4GP43LX5R341187

I haven’t been able to get a trailing wildcard to work at all in this context. Is this not allowed?

cs-host:nmvtis.ssy.local AND cs-uri-stem:\/api\/vin\/VHR\/99999999\/2D4GP43LX5R34118*

I feel like I’m missing something terribly simple here as I feel I have had successful widcard searches previously against other fields.

2

The way you can query fields depends on how which tokenizer and which analyzer have been used when indexing the message.

https://www.elastic.co/guide/en/elasticsearch/reference/5.6/analysis-analyzers.html
https://www.elastic.co/guide/en/elasticsearch/guide/current/analysis-intro.html
https://www.elastic.co/guide/en/elasticsearch/guide/current/configuring-analyzers.html

1 Like
3

Thank you for the Reply Jochen. I’ll take a look at these. I’m guilty of looking first at Graylog documentation and forget too quickly that elasticsearch documentation may have my answers.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.