Marciej,
THis is exactly as I told you. For this type of query you have to specify a "default_field" AND your contend* search query. The default field could be the input of your messages for example, or any other field that is relied to your search. On Wednesday, January 28, 2015 at 1:24:36 PM UTC+1, Maciej Strömich wrote: > > This is not exactly true, or I'm misreading something in the elasticsearch > docs. > > > http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html > > "analyze_wildcard - By default, wildcards terms in a query string are not > analyzed. By setting this value to true, a best effort will be made to > analyze those as well." > > So it looks like the query is just incomplete or maybe there are other > unknown to me reasons behind this behaviour. > > > On Wednesday, January 28, 2015 at 12:59:31 PM UTC+1, Edmundo Alvarez wrote: > >> Hello, >> >> As far as I know, it is not possible to use an exact phrase (a search >> term enclosed in quotation marks) with wildcards inside in Elasticsearch. >> The wildcard will be simply ignored. If you only want to check that your >> query matches both "Missing assetId" and "Missing assetIds", this is what I >> would do: >> >> message:"Missing assetId" OR message:"Missing assetIds" >> >> I hope that helps. >> >> Regards, >> Edmundo >> >> -- >> Developer >> >> Tel.: +49 (0)40 609 452 077 >> Mobile: +49 (0)171 27 22 181 >> Mobile (US): +1 (713) 321 8126 >> Fax.: +49 (0)40 609 452 078 >> >> TORCH GmbH >> Steckelhörn 11 >> 20457 Hamburg >> Germany >> https://www.torch.sh/ >> >> Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 >> Geschäftsführer: Lennart Koopmann (CEO) >> >> > On 28 Jan 2015, at 11:41, Arie <[email protected]> wrote: >> > >> > An the second option I gave, does that work? >> > >> > We experience exactly the same thing. >> > >> > >> > >> > On Tuesday, January 27, 2015 at 2:37:50 PM UTC+1, Maciej Strömich >> wrote: >> > >> > Hi, >> > >> > I know that allow_leading_wildcard_searches and it's used to search >> for terms like *something, and I know that it can cause increased memory >> consumption. >> > >> > My question is strictly connected to the query language. >> > >> > when we query for >> > >> > "Missing assetIds" >> > "Misssing assetIds*" >> > >> > the results are found >> > >> > but when we do a search for >> > >> > "Missing assetId*" >> > >> > there are no results found which is kind of strange because following >> the docs you could assume that this should search for all occurrences of >> Missing assetIds. >> > >> > Maybe we're missing something that's why I've asked about the options >> part :) >> > >> > >> > On Monday, January 26, 2015 at 10:55:47 PM UTC+1, Arie wrote: >> > Hi, >> > >> > such a parameter exist in graylog2.conf, but don't know if it is wise >> to use. >> > >> > allow_leading_wildcard_searches = false >> > >> > If we are using such searches and it is within an know source or other >> qualified field >> > we use # source:<hostname> "last acc*" >> > >> > hth,, >> > Arie. >> > >> > On Monday, January 26, 2015 at 5:28:02 PM UTC+1, Maciej Strömich wrote: >> > Hi, >> > >> > can someone elaborate a bit on using wildcard searches inside double >> quotes in GL? >> > >> > We're running 0.92 and have a case where we need to search for an exact >> phrase with wildcard in the end and it doesn't work for us. >> > >> > e.g. something like message:"Missing assetId*" >> > >> > Maybe there's an option in graylog2-server conf which needs to be >> turned on like allow_leading_wildcard_searches? >> > >> > Digging a bit through a group I found only >> https://groups.google.com/forum/#!searchin/graylog2/wildcard/graylog2/4IQubA243-A/BCnBpW78wQkJ >> >> which can be somehow connected with our issue >> > >> > thanks. >> > >> > -- >> > You received this message because you are subscribed to the Google >> Groups "graylog2" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> an email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. >> >> -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
