# Strange search beaviour

**URL:** <https://community.graylog.org/t/strange-search-beaviour/1068>\
**Category:** Graylog Central (peer support)\
**Created:** [May 8, 2017, 10:33am UTC](https://community.graylog.org/t/strange-search-beaviour/1068 "2017-05-08T10:33:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![halycon](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/halycon/32/307_2.png) [@halycon](https://community.graylog.org/u/halycon)\
**Post date:** [May 8, 2017, 10:33am UTC](https://community.graylog.org/t/strange-search-beaviour/1068/1 "2017-05-08T10:33:42Z")

</div>

Hi,

i am sending my postfix log to graylog. Now i’m trying to find some log entries regarding an specific email adress.  
the mail adress is for example: **john.doe@foo.bar**

When i search

1. john.doe: ok, i get the results.
2. john: no results
3. doe: no results
4. \*doe: wildcard error
5. john\*: ok, i get the results
6. @foo.bar: ok, i get results, but too generous

Why are there no results if i simply search for “john” or “doe”?

Thanks

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 8, 2017, 2:03pm UTC](https://community.graylog.org/t/strange-search-beaviour/1068/2 "2017-05-08T14:03:25Z")

</div>

Hej @halycon

did you look into this documentation? [http://docs.graylog.org/en/2.2/pages/queries.html](http://docs.graylog.org/en/2.2/pages/queries.html)

regards  
Jan

---

<div class="post-metadata">

**Author:** ![halycon](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/halycon/32/307_2.png) [@halycon](https://community.graylog.org/u/halycon)\
**Post date:** [May 9, 2017, 9:28am UTC](https://community.graylog.org/t/strange-search-beaviour/1068/3 "2017-05-09T09:28:44Z")

</div>

Hi @jan  
sure i took a look at it.  
I guess i misunderstood the first example ?

> Messages that include the term ssh: ssh

So “john” isn’t a term in my case? What’s the definitin of “term”.  
The mail adress in the log is john.doe@foo.bar  
So the “term” is the whole address?  
Why is searching for “@foo.bar” working? It’s only part of the term. Same for “john”. But searching for “john” is not working.

I don’t get it.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 9, 2017, 9:38am UTC](https://community.graylog.org/t/strange-search-beaviour/1068/4 "2017-05-09T09:38:33Z")

</div>

you can read on `terms` in the [elasticsearch documentation](https://www.elastic.co/guide/en/elasticsearch/reference/2.4/term-level-queries.html) and within Graylog you can view how the field is split and what terms are identified.

 ![](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/ce4171dfc30f4499a98de8908b81ce88195d7dd4.png)

You can change that with your own mapping if you like to.