Jochen, how is it possible then that I can search not-analyzed fields with wildcards? Suppose we have a field "method". Further, there are two different values in total; first: "dosomething" and second: "doanotherthing". Now if I search for "method:do*thing", I get both values in the result.
What's more, *capital letters mess everything up*. Let's assume the values are "doSomeThing" and "doAnotherThing" in the example above. Searching for "method:do*Thing", the result is *empty*. However, if you avoid capital letters in the search term, i.e. "method:do*hing", both values "doSomeThing" and "doAnotherThing" are found. Could you please explain why this is and what to do about it? Cheers, Carlos -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/ecb910dc-f9ef-463e-9ecb-f5bf5543f921%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
