Thanks for clarifications. I think I found a workaround for my issue: source:staging* AND message:(Missing AND assetId*)
which is not "beautiful" but does it's job. Thanks for your time On Wednesday, January 28, 2015 at 1:45:37 PM UTC+1, Arie wrote: > > Marciej, > > > THis is exactly as I told you. > > For this type of query you have to specify a "default_field" AND your > contend* search query. > > The default field could be the input of your messages for example, or any > other field that is relied to your search. > > > On Wednesday, January 28, 2015 at 1:24:36 PM UTC+1, Maciej Strömich wrote: >> >> This is not exactly true, or I'm misreading something in the >> elasticsearch docs. >> >> >> http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html >> >> "analyze_wildcard - By default, wildcards terms in a query string are not >> analyzed. By setting this value to true, a best effort will be made to >> analyze those as well." >> >> So it looks like the query is just incomplete or maybe there are other >> unknown to me reasons behind this behaviour. >> >> >> On Wednesday, January 28, 2015 at 12:59:31 PM UTC+1, Edmundo Alvarez >> wrote: >> >>> Hello, >>> >>> As far as I know, it is not possible to use an exact phrase (a search >>> term enclosed in quotation marks) with wildcards inside in Elasticsearch. >>> The wildcard will be simply ignored. If you only want to check that your >>> query matches both "Missing assetId" and "Missing assetIds", this is what I >>> would do: >>> >>> message:"Missing assetId" OR message:"Missing assetIds" >>> >>> I hope that helps. >>> >>> Regards, >>> Edmundo >>> >>> -- >>> Developer >>> >>> Tel.: +49 (0)40 609 452 077 >>> Mobile: +49 (0)171 27 22 181 >>> Mobile (US): +1 (713) 321 8126 >>> Fax.: +49 (0)40 609 452 078 >>> >>> TORCH GmbH >>> Steckelhörn 11 >>> 20457 Hamburg >>> Germany >>> https://www.torch.sh/ >>> >>> Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 >>> Geschäftsführer: Lennart Koopmann (CEO) >>> >>> > On 28 Jan 2015, at 11:41, Arie <[email protected]> wrote: >>> > >>> > An the second option I gave, does that work? >>> > >>> > We experience exactly the same thing. >>> > >>> > >>> > >>> > On Tuesday, January 27, 2015 at 2:37:50 PM UTC+1, Maciej Strömich >>> wrote: >>> > >>> > Hi, >>> > >>> > I know that allow_leading_wildcard_searches and it's used to search >>> for terms like *something, and I know that it can cause increased memory >>> consumption. >>> > >>> > My question is strictly connected to the query language. >>> > >>> > when we query for >>> > >>> > "Missing assetIds" >>> > "Misssing assetIds*" >>> > >>> > the results are found >>> > >>> > but when we do a search for >>> > >>> > "Missing assetId*" >>> > >>> > there are no results found which is kind of strange because following >>> the docs you could assume that this should search for all occurrences of >>> Missing assetIds. >>> > >>> > Maybe we're missing something that's why I've asked about the options >>> part :) >>> > >>> > >>> > On Monday, January 26, 2015 at 10:55:47 PM UTC+1, Arie wrote: >>> > Hi, >>> > >>> > such a parameter exist in graylog2.conf, but don't know if it is wise >>> to use. >>> > >>> > allow_leading_wildcard_searches = false >>> > >>> > If we are using such searches and it is within an know source or other >>> qualified field >>> > we use # source:<hostname> "last acc*" >>> > >>> > hth,, >>> > Arie. >>> > >>> > On Monday, January 26, 2015 at 5:28:02 PM UTC+1, Maciej Strömich >>> wrote: >>> > Hi, >>> > >>> > can someone elaborate a bit on using wildcard searches inside double >>> quotes in GL? >>> > >>> > We're running 0.92 and have a case where we need to search for an >>> exact phrase with wildcard in the end and it doesn't work for us. >>> > >>> > e.g. something like message:"Missing assetId*" >>> > >>> > Maybe there's an option in graylog2-server conf which needs to be >>> turned on like allow_leading_wildcard_searches? >>> > >>> > Digging a bit through a group I found only >>> https://groups.google.com/forum/#!searchin/graylog2/wildcard/graylog2/4IQubA243-A/BCnBpW78wQkJ >>> >>> which can be somehow connected with our issue >>> > >>> > thanks. >>> > >>> > -- >>> > You received this message because you are subscribed to the Google >>> Groups "graylog2" group. >>> > To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> > For more options, visit https://groups.google.com/d/optout. >>> >>> -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
