I'm trying to understand a search issue with Graylog2 http://graylog2.org/
.
This is an example of how Graylog store data(taken from a successful query)
:
{
"_id": "Z5y6mxR-QBejYdDI07Ax3A",
"_index": "graylog2",
"_score": 1.4142135,
"_source": {
"_Comp": "app",
"_Env": "production",
"_Short_path": "some_file.log",
"created_at": 1348465507.609,
"facility": "logstash-gelf",
"file":
"file:/usr/local/logstash/logstash-1.1.1-monolithic.jar!/logstash/outputs/gelf.rb",
"full_message": "Stacktrace:\norg.apache.jasper.JasperException:
Exception in JSP: /jsp/mobile/some_file.jsp:31",
"host": "some_host",
"level": 7,
"line": 138,
"message": "Stacktrace:\norg.apache.jasper.JasperException: Exception
in JSP: /jsp/mobile/some_file.jsp:31",
"streams": [
"50558899fb7f611830000019"
]
},
"_type": "message"
}
This is how Graylog2 tries(and fails) to search for data when I search
for JasperException (its a full text search as this string is
not separated by whitespace )
{
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "message:JasperException"
}
},
{
"range": {
"created_at": {
"gt": 1348465507,
"lt": 1348465508
}
}
}
]
}
},
"size": 5
}'
But if I change the query_string from "query": "message
:JasperException" to "query": "_all:JasperException" it works.
As the substring 'JasperException' is clearly present in the message field
I don't understand why the query graylog uses doesn't work.
Can anybody shed some light on this ?
--