Not really because when you do source:<hostname> "Missing assetId*"
you are doing OR and not AND. So all messages containing a hostname OR a "Missing assetId*" is being searched. When you add AND then no messages are found when using a wildcard. On Wednesday, January 28, 2015 at 11:41:51 AM UTC+1, Arie wrote: > > An the second option I gave, does that work? > > We experience exactly the same thing. > > > > On Tuesday, January 27, 2015 at 2:37:50 PM UTC+1, Maciej Strömich wrote: >> >> >> Hi, >> >> I know that allow_leading_wildcard_searches and it's used to search for >> terms like *something, and I know that it can cause increased memory >> consumption. >> >> My question is strictly connected to the query language. >> >> when we query for >> >> "Missing assetIds" >> "Misssing assetIds*" >> >> the results are found >> >> but when we do a search for >> >> "Missing assetId*" >> >> there are no results found which is kind of strange because following the >> docs you could assume that this should search for all occurrences of >> Missing assetIds. >> >> Maybe we're missing something that's why I've asked about the options >> part :) >> >> >> On Monday, January 26, 2015 at 10:55:47 PM UTC+1, Arie wrote: >>> >>> Hi, >>> >>> such a parameter exist in graylog2.conf, but don't know if it is wise to >>> use. >>> >>> allow_leading_wildcard_searches = false >>> >>> If we are using such searches and it is within an know source or other >>> qualified field >>> we use # source:<hostname> "last acc*" >>> >>> hth,, >>> Arie. >>> >>> On Monday, January 26, 2015 at 5:28:02 PM UTC+1, Maciej Strömich wrote: >>>> >>>> Hi, >>>> >>>> can someone elaborate a bit on using wildcard searches inside double >>>> quotes in GL? >>>> >>>> We're running 0.92 and have a case where we need to search for an exact >>>> phrase with wildcard in the end and it doesn't work for us. >>>> >>>> e.g. something like message:"Missing assetId*" >>>> >>>> Maybe there's an option in graylog2-server conf which needs to be >>>> turned on like allow_leading_wildcard_searches? >>>> >>>> Digging a bit through a group I found only >>>> https://groups.google.com/forum/#!searchin/graylog2/wildcard/graylog2/4IQubA243-A/BCnBpW78wQkJ >>>> >>>> which can be somehow connected with our issue >>>> >>>> thanks. >>>> >>> -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
