Strange search beaviour

Graylog Central (peer support)
1

Hi,

i am sending my postfix log to graylog. Now i’m trying to find some log entries regarding an specific email adress.
the mail adress is for example: john.doe@foo.bar

When i search

  1. john.doe: ok, i get the results.
  2. john: no results
  3. doe: no results
  4. *doe: wildcard error
  5. john*: ok, i get the results
  6. @foo.bar: ok, i get results, but too generous

Why are there no results if i simply search for “john” or “doe”?

Thanks

2

Hej @halycon

did you look into this documentation? http://docs.graylog.org/en/2.2/pages/queries.html

regards
Jan

3

Hi @jan
sure i took a look at it.
I guess i misunderstood the first example ?

Messages that include the term ssh: ssh

So “john” isn’t a term in my case? What’s the definitin of “term”.
The mail adress in the log is john.doe@foo.bar
So the “term” is the whole address?
Why is searching for “@foo.bar” working? It’s only part of the term. Same for “john”. But searching for “john” is not working.

I don’t get it.

4

you can read on terms in the elasticsearch documentation and within Graylog you can view how the field is split and what terms are identified.

show_terms.png924×199 21.9 KB

You can change that with your own mapping if you like to.