Hi Claus, not all message fields are being analyzed during index time, which enables wildcard searches in the first place. By default, only message, full_message, and source are being analyzed. If you want to analyze other message fields as well, you'll need to create an Elasticsearch index template with the appropriate mapping: https://www.elastic.co/guide/en/elasticsearch/reference/1.7/indices-templates.html
Cheers, Jochen On Thursday, 17 September 2015 13:44:48 UTC+2, Claus Koell wrote: > > Hi ! > > We have a Input that extract some fields with regular expressions from > messages coming from a apache access-log > One resulting field is called path. > > Some values in that field look like > > /primefaces/5.1.14/primefaces.css > /mahara/view/blocks.json.php > /TestWeb/sample.do > > If i try to search with wildcards it looks like that values with a lower > "beginning" will be found > > Sample search strings with results: > > path:\/primefaces\/5.1.14\/* > path:\/mahara\/view\/* > > If i try this search i get no results > > path:\/TestWeb\/* > > Trying to search for a valid value without wildcard works fine > > path:\/TestWeb\/sample.do > > Thanks for any tip ! > > > > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/ed889e93-c0ad-4ece-885b-32fc1e4a8e65%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
