Strange search beaviour


(halycon) #1

Hi,

i am sending my postfix log to graylog. Now i’m trying to find some log entries regarding an specific email adress.
the mail adress is for example: john.doe@foo.bar

When i search

  1. john.doe: ok, i get the results.
  2. john: no results
  3. doe: no results
  4. *doe: wildcard error
  5. john*: ok, i get the results
  6. @foo.bar: ok, i get results, but too generous

Why are there no results if i simply search for “john” or “doe”?

Thanks


(Jan Doberstein) #2

Hej @halycon

did you look into this documentation? http://docs.graylog.org/en/2.2/pages/queries.html

regards
Jan


(halycon) #3

Hi @jan
sure i took a look at it.
I guess i misunderstood the first example ?

Messages that include the term ssh: ssh

So “john” isn’t a term in my case? What’s the definitin of “term”.
The mail adress in the log is john.doe@foo.bar
So the “term” is the whole address?
Why is searching for “@foo.bar” working? It’s only part of the term. Same for “john”. But searching for “john” is not working.

I don’t get it.


(Jan Doberstein) #4

you can read on terms in the elasticsearch documentation and within Graylog you can view how the field is split and what terms are identified.

You can change that with your own mapping if you like to.