I don't think that information is related to the issue you reported, at least if I understood it correctly.
As far as I know, we always use query string queries for searching. Anyway, when you type the term assetId* (without quotes), your wildcard gets analysed correctly or it should in most cases (things are more complicated than that). The moment when the wildcard is ignored is when you look for an exact phrase like "Message assetId*". Looking around a little I could find this message that reports the same issue: http://elasticsearch-users.115913.n3.nabble.com/Wildcards-in-exact-phrase-in-query-string-search-td4020826.html Regards, Edmundo -- Developer Tel.: +49 (0)40 609 452 077 Mobile: +49 (0)171 27 22 181 Mobile (US): +1 (713) 321 8126 Fax.: +49 (0)40 609 452 078 TORCH GmbH Steckelhörn 11 20457 Hamburg Germany https://www.torch.sh/ Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 Geschäftsführer: Lennart Koopmann (CEO) > On 28 Jan 2015, at 13:24, Maciej Strömich <[email protected]> wrote: > > This is not exactly true, or I'm misreading something in the elasticsearch > docs. > > http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html > > "analyze_wildcard - By default, wildcards terms in a query string are not > analyzed. By setting this value to true, a best effort will be made to > analyze those as well." > > So it looks like the query is just incomplete or maybe there are other > unknown to me reasons behind this behaviour. > > > On Wednesday, January 28, 2015 at 12:59:31 PM UTC+1, Edmundo Alvarez wrote: > Hello, > > As far as I know, it is not possible to use an exact phrase (a search term > enclosed in quotation marks) with wildcards inside in Elasticsearch. The > wildcard will be simply ignored. If you only want to check that your query > matches both "Missing assetId" and "Missing assetIds", this is what I would > do: > > message:"Missing assetId" OR message:"Missing assetIds" > > I hope that helps. > > Regards, > Edmundo > > -- > Developer > > Tel.: +49 (0)40 609 452 077 > Mobile: +49 (0)171 27 22 181 > Mobile (US): +1 (713) 321 8126 > Fax.: +49 (0)40 609 452 078 > > TORCH GmbH > Steckelhörn 11 > 20457 Hamburg > Germany > https://www.torch.sh/ > > Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 > Geschäftsführer: Lennart Koopmann (CEO) > > > On 28 Jan 2015, at 11:41, Arie <[email protected]> wrote: > > > > An the second option I gave, does that work? > > > > We experience exactly the same thing. > > > > > > > > On Tuesday, January 27, 2015 at 2:37:50 PM UTC+1, Maciej Strömich wrote: > > > > Hi, > > > > I know that allow_leading_wildcard_searches and it's used to search for > > terms like *something, and I know that it can cause increased memory > > consumption. > > > > My question is strictly connected to the query language. > > > > when we query for > > > > "Missing assetIds" > > "Misssing assetIds*" > > > > the results are found > > > > but when we do a search for > > > > "Missing assetId*" > > > > there are no results found which is kind of strange because following the > > docs you could assume that this should search for all occurrences of > > Missing assetIds. > > > > Maybe we're missing something that's why I've asked about the options part > > :) > > > > > > On Monday, January 26, 2015 at 10:55:47 PM UTC+1, Arie wrote: > > Hi, > > > > such a parameter exist in graylog2.conf, but don't know if it is wise to > > use. > > > > allow_leading_wildcard_searches = false > > > > If we are using such searches and it is within an know source or other > > qualified field > > we use # source:<hostname> "last acc*" > > > > hth,, > > Arie. > > > > On Monday, January 26, 2015 at 5:28:02 PM UTC+1, Maciej Strömich wrote: > > Hi, > > > > can someone elaborate a bit on using wildcard searches inside double quotes > > in GL? > > > > We're running 0.92 and have a case where we need to search for an exact > > phrase with wildcard in the end and it doesn't work for us. > > > > e.g. something like message:"Missing assetId*" > > > > Maybe there's an option in graylog2-server conf which needs to be turned on > > like allow_leading_wildcard_searches? > > > > Digging a bit through a group I found only > > https://groups.google.com/forum/#!searchin/graylog2/wildcard/graylog2/4IQubA243-A/BCnBpW78wQkJ > > which can be somehow connected with our issue > > > > thanks. > > > > -- > > You received this message because you are subscribed to the Google Groups > > "graylog2" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [email protected]. > > For more options, visit https://groups.google.com/d/optout. > > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
