Unable to create filters using * wildcard with filebeat_log_file_path:

Graylog Central (peer support)
1

Hello Graylog Team,

I am stuck with creation of filters using filebeat_log_file_path: with multiple values to search from various locations at the same time. The path names are similar to each other, so to search a particular message from all such locations I have used a * wild-card which does not help me by providing expected output.

Please have a look at the below snippet which will help to understand the issue.

filebeat_log_file_path: /data/logs/trial11app0*/ AND message:“DECLINE”

Here, I am trying to search the message “DECLINE” from multiple paths like “/data/logs/trial11app01”, “/data/logs/trial11app02”, “/data/logs/trial11app03” and “/data/logs/trial11app04” where by I have kept my local logs.

The search works when I enter the below query for each path:

  1. filebeat_log_file_path: /data/logs/trial11app01/ AND message:“DECLINE”
  2. filebeat_log_file_path: /data/logs/trial11app02/ AND message:“DECLINE”
  3. filebeat_log_file_path: /data/logs/trial11app03/ AND message:“DECLINE”
  4. filebeat_log_file_path: /data/logs/trial11app04/ AND message:“DECLINE”

Is there any way that it can work without any problem by using any wild-card like * or anything else?

Thanks in advance for your help.

Regards,
Rajendra

2

he Rajendra,

you need to escape some characters in your query … please see the documentation on this: http://docs.graylog.org/en/3.0/pages/queries.html

In addition it makes a difference how you have stored and saved the data in elasticsearch - without that knowledge it is nearly impossible to give you a solution at hand. You should check really the docs first.

3

Hey Jan,

Thanks for helping me out here.

I tried to modify my query by referring the documentation link you shared.

Below is the modified filter that gave me the expected results:

message:“DECLINE” AND (filebeat_log_file_path:/data/logs/trial11app01 OR filebeat_log_file_path:/data/logs/trial11app02 OR filebeat_log_file_path:/data/logs/trial11app03 OR filebeat_log_file_path:/data/logs/trial11app04)

Request you to please help me with some idea which can reduce the size of my query. I am refering to the individual reference of the path_names that I have to write explicitly .i.e. trial11app01,trial11app02,trial11app03 and trial11app04.

Can use of a wild-card help reduce this effort?

Have a nice day ahead!

Regards,
Rajendra

4

He Rajendra

wildcards can be used - but you need to check how the data is stored in the backend. If the data is analyzed or not makes a difference.

5

Hello Jan,

Thanks for your help. I really appreciate your quick turnaround to my queries.

Good Day!

-Rajendra

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.