Wildcard Search

Graylog Central (peer support)
1

Trying to search with trailing wildcards in Graylog 4.2.4 and it does not work.

We have source fields like “app-12345-12345”
So searching for “source:app\-12345\-12345” is ok
searching for “source:app\-12345\-???” is ok
but “source:app\-12345\-.*” gives no results at all.

What am I doing wrong?

2

There is a formatting tool for the forum </> that helps when posting code - usng that and putting in your queries:

"app-12345-12345"
"source:app\-12345\-12345"
"source:app\-12345\-???" 
"source:app\-12345\-.*"

I see in the last one you have a dot before the asterisk… regex style. You can remove the dot or you can change the search to be regex by bracketing it with / to denote regex… like so:

source:/app\-12345\-.*/

1 Like
3

Note that leading wildcards are disabled to avoid excessive memory consumption! You can enable them in your Graylog configuration file:

allow_leading_wildcard_searches = true

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.