This is not exactly true, or I'm misreading something in the elasticsearch docs.
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html "analyze_wildcard - By default, wildcards terms in a query string are not analyzed. By setting this value to true, a best effort will be made to analyze those as well." So it looks like the query is just incomplete or maybe there are other unknown to me reasons behind this behaviour. On Wednesday, January 28, 2015 at 12:59:31 PM UTC+1, Edmundo Alvarez wrote: > Hello, > > As far as I know, it is not possible to use an exact phrase (a search term > enclosed in quotation marks) with wildcards inside in Elasticsearch. The > wildcard will be simply ignored. If you only want to check that your query > matches both "Missing assetId" and "Missing assetIds", this is what I would > do: > > message:"Missing assetId" OR message:"Missing assetIds" > > I hope that helps. > > Regards, > Edmundo > > -- > Developer > > Tel.: +49 (0)40 609 452 077 > Mobile: +49 (0)171 27 22 181 > Mobile (US): +1 (713) 321 8126 > Fax.: +49 (0)40 609 452 078 > > TORCH GmbH > Steckelhörn 11 > 20457 Hamburg > Germany > https://www.torch.sh/ > > Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 > Geschäftsführer: Lennart Koopmann (CEO) > > > On 28 Jan 2015, at 11:41, Arie <[email protected] <javascript:>> > wrote: > > > > An the second option I gave, does that work? > > > > We experience exactly the same thing. > > > > > > > > On Tuesday, January 27, 2015 at 2:37:50 PM UTC+1, Maciej Strömich wrote: > > > > Hi, > > > > I know that allow_leading_wildcard_searches and it's used to search for > terms like *something, and I know that it can cause increased memory > consumption. > > > > My question is strictly connected to the query language. > > > > when we query for > > > > "Missing assetIds" > > "Misssing assetIds*" > > > > the results are found > > > > but when we do a search for > > > > "Missing assetId*" > > > > there are no results found which is kind of strange because following > the docs you could assume that this should search for all occurrences of > Missing assetIds. > > > > Maybe we're missing something that's why I've asked about the options > part :) > > > > > > On Monday, January 26, 2015 at 10:55:47 PM UTC+1, Arie wrote: > > Hi, > > > > such a parameter exist in graylog2.conf, but don't know if it is wise to > use. > > > > allow_leading_wildcard_searches = false > > > > If we are using such searches and it is within an know source or other > qualified field > > we use # source:<hostname> "last acc*" > > > > hth,, > > Arie. > > > > On Monday, January 26, 2015 at 5:28:02 PM UTC+1, Maciej Strömich wrote: > > Hi, > > > > can someone elaborate a bit on using wildcard searches inside double > quotes in GL? > > > > We're running 0.92 and have a case where we need to search for an exact > phrase with wildcard in the end and it doesn't work for us. > > > > e.g. something like message:"Missing assetId*" > > > > Maybe there's an option in graylog2-server conf which needs to be turned > on like allow_leading_wildcard_searches? > > > > Digging a bit through a group I found only > https://groups.google.com/forum/#!searchin/graylog2/wildcard/graylog2/4IQubA243-A/BCnBpW78wQkJ > > which can be somehow connected with our issue > > > > thanks. > > > > -- > > You received this message because you are subscribed to the Google > Groups "graylog2" group. > > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
