Hi Frank, thanks for the tip "field analyze", that was the right way. Elasticsearch uses per default dynamic Mapping as described here https://www.elastic.co/guide/en/elasticsearch/guide/2.x/dynamic-mapping.html .
I can use different type of fix mapping e.g in Elasticsearch, maybe i use Logstash or use the easy way in graylog (use an extractor as seen above). We test this and get our solution to work. Thanks and have nice day John PS: yes we activate leading wildcards and highlighting in graylog (testing performance is ok) Am Dienstag, 14. Februar 2017 10:42:48 UTC+1 schrieb Frank Engler: > > Am Montag, 13. Februar 2017, 23:54:41 schrieb celtar: > > agent = (Original Message) : "Mozilla/5.0 (compatible; Googlebot/2.1; > > +http://www.google.com/bot.html)" > > > 1. Search = Input.... AND agent:*Googlebot* = result none found > > 2. Search = Input....AND agent:*Googleb* = result none found > > 3. Search = Input.... AND agent:*Google* = graylog result = ok but i > think > > graylog only found the string google from www.google.com > > > > I try different ways to search Google* or *Google Google "Googlebot". > > Every time it is the same result. Google was found but not the String > > Googlbot > > > > Is there any Syntax failure in searching or maybe it is not possible. > > > > Do i have to use another Inputfilter (like Logstash)? > > > > The same problem have we with different search string (not only > apache-gelf > > module). > > > > Thanks for helping and have a great day > > > > :) John Celtar > > Did you allow leading wildcards for searches in graylog.conf? > Did you enable an analyzer for the agent field in the elasticsearch > template? > > > Frank > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/19187eee-10d7-4041-89e1-e3d849839212%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
