I know i’ve missed a step somewhere or done something dumb because i always do.
I can no longer issue a search with an OR set, i.e. winlogbeat_event_id:( 4728 4729 ) will return nothing, but doing each numeric id individually will work fine. A standard OR search will work fine.
winlogbeat_event_id: 4728 OR winlogbeat_event_id: 4729
Every other search type i can think of works fine
If i pick an Index from prior to the upgrade, i get the following error but i cannot seem to find a relevant log with an error on any of my graylog nodes.
Unable to perform search query failed to create query: {
“bool” : { “must” : [ { “query_string” : { “query” : “winlogbeat_event_id:( 4728 4729 )”, “fields” : , “type” : “best_fields”, “default_operator” : “or”, “max_determinized_states” : 10000, “allow_leading_wildcard” : false, “enable_position_increments” : true, “fuzziness” : “AUTO”, “fuzzy_prefix_length” : 0, “fuzzy_max_expansions” : 50, “phrase_slop” : 0, “escape” : false, “auto_generate_synonyms_phrase_query” : true, “fuzzy_transpositions” : true, “boost” : 1.0 } } ], “filter” : [ { “bool” : { “must” : [ { “range” : { “timestamp” : { “from” : “2018-12-13 21:37:12.694”, “to” : “2018-12-20 21:37:12.694”, “include_lower” : true, “include_upper” : true, “boost” : 1.0 } } } ], “adjust_pure_negative” : true, “boost” : 1.0 } } ], “adjust_pure_negative” : true, “boost” : 1.0 } }
Details:
failed to create query: { "bool" : { "must" : [ { "query_string" : { "query" : "winlogbeat_event_id:( 4728 4729 )", "fields" : [ ], "type" : "best_fields", "default_operator" : "or", "max_determinized_states" : 10000, "allow_leading_wildcard" : false, "enable_position_increments" : true, "fuzziness" : "AUTO", "fuzzy_prefix_length" : 0, "fuzzy_max_expansions" : 50, "phrase_slop" : 0, "escape" : false, "auto_generate_synonyms_phrase_query" : true, "fuzzy_transpositions" : true, "boost" : 1.0 } } ], "filter" : [ { "bool" : { "must" : [ { "range" : { "timestamp" : { "from" : "2018-12-13 21:37:12.694", "to" : "2018-12-20 21:37:12.694", "include_lower" : true, "include_upper" : true, "boost" : 1.0 } } } ], "adjust_pure_negative" : true, "boost" : 1.0 } } ], "adjust_pure_negative" : true, "boost" : 1.0 } }
Search status code:
500
Search response:
cannot GET https://:9000/api/search/universal/relative?query=winlogbeat_event_id%3A%28%204728%204729%20%29&range=604800&limit=150&sort=timestamp%3Adesc (500)