I am using FileBeat to collect logs from docker containers, the logs are sent to logstash and eventually end up in ES for viewing in Kibana. Given the two log entries below;
2018-07-18 21:28:26.760 INFO [foo-service,ef48be8c13ae0d81,192d6982b1eeca95,false] 6 --- [nio-8087-exec-1] a.s.r.foo.controllers.FooController : doFooThings() duration (ms): 14 2018-07-18 21:28:26.383 INFO [bar-service,ef48be8c13ae0d81,f468cbb60ed98371,false] 6 --- [io-8085-exec-10] a.s.r.foo.controllers.BarController : doBarThings(): duration (ms): 10
In Kibana, I enter "message: ef48be8c13ae0d81" to search, however, only the 2nd line (with "ef48be8c13ae0d81,f468cbb60ed98371") is returned. When I enter "message: ef48be8c13ae0d81*" both are returned.
Another behavior I am noticing is when I use "message: ef48be8c13ae0d81*", the result text is highlighted as below;
- ef48be8c13ae0d81,192d6982b1eeca95 --- this string is highlighted (first log entry)
- ef48be8c13ae0d81 --- only this string is highlighted (second log entry)
- It looks like it can do partial text search, but why doesn't it return the 2 results as "ef48be8c13ae0d81" is in the two log entries?
- The highlighting, why is it different?
Thanks in advance for any suggestions you may have.