[graylog2] Re: Search Issue ...

2015-09-16 Thread Drew Miranda 
Are you using the prebuilt filter via this method? Also are you using a 
relative or absolute time range search?

1. Find message that contains the field you want to filter by
2. Expand message by clicking (to show all fields with the Magnifying logo)
3. Click on the Magnifying logo for the field you want to filter, it will add 
that criteria to the search box

Does this filter differ from what you had already typed?

Also is you click on the "arrow pointing downward" next to that same field and 
select "show terms of..." does it show the words contained in the filename path?

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/711b7de6-9491-4972-9c4d-8b5689a48639%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Search Issue ...

2015-09-14 Thread Jochen Schalanda 
Hi Claus,

certain characters have to be escaped in the Lucene query syntax (which is 
being used by Graylog and Elasticsearch), see 
http://docs.graylog.org/en/1.1/pages/queries.html#escaping for details.


Cheers,
Jochen

On Tuesday, 8 September 2015 10:31:14 UTC+2, Claus Koell wrote:
>
> Hi !
>
> We are using graylog 1.1.6 and we have troubles with some search strings. 
> We are using a collector to reading files 
> from a windows system. We can see a field named 'source_file' in these 
> messages
>
> Sample Value: C:\Program 
> Files\IBM\WebSphere\AppServer8\profiles\AppSrv01\logs\MyServer\SystemOut.log
>
> If we try to search for all logs from a specific source_file it does not 
> work.
>
> This is the elastic search query:
>
> {
>   "from": 0,
>   "size": 100,
>   "query": {
> "query_string": {
>   "query": "source_file:\"C:\\Program 
> Files\\IBM\\WebSphere\\AppServer8\\profiles\\AppSrv01\\logs\\MyServer\\SystemOut.log\"",
>   "allow_leading_wildcard": false
> }
>   },
>   "post_filter": {
> "bool": {
>   "must": {
> "range": {
>   "timestamp": {
> "from": "2015-09-08 00:28:10.547",
> "to": "2015-09-08 08:28:10.547",
> "include_lower": true,
> "include_upper": true
>   }
> }
>   }
> }
>   },
>   "sort": [
> {
>   "timestamp": {
> "order": "desc"
>   }
> }
>   ]
> }
>
> Maybe the backslashes make the trouble ?
>
> thanks for help !
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/5437d888-0c91-4726-8101-3f3f3ef0feaf%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Search Issue ...

2015-09-14 Thread Claus Koell 
Hi again !

Forgot to escape the ':' character

source_file:"C\:\\Program 
Files\\IBM\WebSphere\\AppServer8\\profiles\\AppSrv01\\logs\\MyServer\\SystemOut.log"

but nothing wil be found.

Do i overlook something?

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/df6e02ef-c71f-411e-b840-8ed2ac2e4eb5%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.