Hi, i found it. I have to use Extractors.
http://docs.graylog.org/en/2.1/pages/extractors.html Thx john celtar Am Dienstag, 14. Februar 2017 08:54:42 UTC+1 schrieb celtar: > > Hi, > > we use graylog 2.1.2 with the apache-gelf Module from the marketplace. > > If we try to search "Googlebot" in this string (type agent:) > > agent = (Original Message) : "Mozilla/5.0 (compatible; Googlebot/2.1; + > http://www.google.com/bot.html)" > > 1. Search = Input.... AND agent:*Googlebot* = result none found > > 2. Search = Input....AND agent:*Googleb* = result none found > > 3. Search = Input.... AND agent:*Google* = graylog result = ok but i > think graylog only found the string google from www.google.com > > I try different ways to search Google* or *Google Google "Googlebot". > Every time it is the same result. Google was found but not the String > Googlbot > > Is there any Syntax failure in searching or maybe it is not possible. > > Do i have to use another Inputfilter (like Logstash)? > > The same problem have we with different search string (not only > apache-gelf module). > > Thanks for helping and have a great day > > :) John Celtar > > > > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/ac00d003-5071-4db7-b8e3-3cbb6c161603%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
