graylog

Log search for multiple occurrences of full_message


Application logs are written about the launch of methods and the parameters being passed. Example: Call Method(1, "1,2,3,4,5"). Client IP 8.8.8.8. Waiting time in queue: 00:00:000. Execution time: 00:00:109. Total call time: 00:00:109

Question: How to build a search query for multiple occurrences? Need to search by method and filter by some ID in the message (it's "1,2,3,4,5")

Something like: full_message:"Method call" AND full_message:/2+/. When I call such a search, nothing is returned, although I am sure that there is such a log.

The result is achieved if the ID is passed in full, but, accordingly, I need to play with them, because they can be sent in different order.

full_message:"Method call" AND full_message:\"1,2,3,4,5\" - working fine


Solution

  • done with full_message:"Method call" AND full_message:/.*2.*/