Searching question

Have a quick search question. Having trouble matching anything with a wildcard after a specific string in a field. Here is an example that works.

cs-host:nmvtis.ssy.local AND cs-uri-stem:\/api\/vin\/VHR\/99999999\/2D4GP43LX5R341187

I haven’t been able to get a trailing wildcard to work at all in this context. Is this not allowed?

cs-host:nmvtis.ssy.local AND cs-uri-stem:\/api\/vin\/VHR\/99999999\/2D4GP43LX5R34118*

I feel like I’m missing something terribly simple here as I feel I have had successful widcard searches previously against other fields.

The way you can query fields depends on how which tokenizer and which analyzer have been used when indexing the message.

1 Like

Thank you for the Reply Jochen. I’ll take a look at these. I’m guilty of looking first at Graylog documentation and forget too quickly that elasticsearch documentation may have my answers.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.