Trying to search with trailing wildcards in Graylog 4.2.4 and it does not work.
We have source fields like “app-12345-12345”
So searching for “source:app\-12345\-12345” is ok
searching for “source:app\-12345\-???” is ok
but “source:app\-12345\-.*” gives no results at all.
What am I doing wrong?
There is a formatting tool for the forum
</> that helps when posting code - usng that and putting in your queries:
I see in the last one you have a dot before the asterisk… regex style. You can remove the dot or you can change the search to be regex by bracketing it with
/ to denote regex… like so:
Note that leading wildcards are disabled to avoid excessive memory consumption! You can enable them in your Graylog configuration file:
allow_leading_wildcard_searches = true
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.