Hello Graylog Team,
I am stuck with creation of filters using filebeat_log_file_path: with multiple values to search from various locations at the same time. The path names are similar to each other, so to search a particular message from all such locations I have used a * wild-card which does not help me by providing expected output.
Please have a look at the below snippet which will help to understand the issue.
filebeat_log_file_path: /data/logs/trial11app0*/ AND message:“DECLINE”
Here, I am trying to search the message “DECLINE” from multiple paths like “/data/logs/trial11app01”, “/data/logs/trial11app02”, “/data/logs/trial11app03” and “/data/logs/trial11app04” where by I have kept my local logs.
The search works when I enter the below query for each path:
- filebeat_log_file_path: /data/logs/trial11app01/ AND message:“DECLINE”
- filebeat_log_file_path: /data/logs/trial11app02/ AND message:“DECLINE”
- filebeat_log_file_path: /data/logs/trial11app03/ AND message:“DECLINE”
- filebeat_log_file_path: /data/logs/trial11app04/ AND message:“DECLINE”
Is there any way that it can work without any problem by using any wild-card like * or anything else?
Thanks in advance for your help.
you need to escape some characters in your query … please see the documentation on this: http://docs.graylog.org/en/3.0/pages/queries.html
In addition it makes a difference how you have stored and saved the data in elasticsearch - without that knowledge it is nearly impossible to give you a solution at hand. You should check really the docs first.
Thanks for helping me out here.
I tried to modify my query by referring the documentation link you shared.
Below is the modified filter that gave me the expected results:
message:“DECLINE” AND (filebeat_log_file_path:/data/logs/trial11app01 OR filebeat_log_file_path:/data/logs/trial11app02 OR filebeat_log_file_path:/data/logs/trial11app03 OR filebeat_log_file_path:/data/logs/trial11app04)
Request you to please help me with some idea which can reduce the size of my query. I am refering to the individual reference of the path_names that I have to write explicitly .i.e. trial11app01,trial11app02,trial11app03 and trial11app04.
Can use of a wild-card help reduce this effort?
Have a nice day ahead!
wildcards can be used - but you need to check how the data is stored in the backend. If the data is analyzed or not makes a difference.
Thanks for your help. I really appreciate your quick turnaround to my queries.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.