Graylog2 / Graylog2/graylog2-server

Search query escape character doesn't work

Open
#14,165 3 comments 0 reactions 1 assignee Claimed by @kroepke View on GitHub
bug to-verify
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

As per [this documentation article](https://go2docs.graylog.org/5-0/making_sense_of_your_log_data/writing_search_queries.html#Escaping), when doing a search query that has a special character - it has to be escaped by a backslash. So if I'm searching for e.g. _deso-mgmt01_ I have to write it like this: _deso\\-mgmt01_.

## Current Behavior

With that said, searching for this particular string by either _deso-mgmt01_ or _deso\\-mgmt01_ I get all, and identical, results that contain the deso part. without any regard for what comes after, escaped or not:
![image](https://user-images.githubusercontent.com/102314521/206467214-eb060d6d-53d8-4481-a1e4-606435720fa3.png)
![image](https://user-images.githubusercontent.com/102314521/206467367-9a0e44f5-67a8-48f3-bcd8-eacb47a7c396.png)

I do get more precise results if I try to search by putting the string in double quotes like _"deso-mgmt01"_ :
![image](https://user-images.githubusercontent.com/102314521/206467624-4c1cbd55-3da9-47ef-859b-a35c44441d83.png)

but doing it this way is even more inconsistent, in part, probably because it searches for the exact string. But then again I have two tables where I have that same string in a separate field, and putting it in double quotes shows the values only in one of the two tables, which makes no sense whatsoever.

## Possible Solution

## Steps to Reproduce (for bugs)

1. Search for some value that has a special character in the name, such as a dash (-)
2. Try to escape it with a backslash (\)
3. Try to put the string in double quotes
4. Observe the behavior

## Context

**What are you trying to accomplish?**
I'm trying to use the search as advertised.
## Your Environment

* Graylog Version: Graylog 4.3.9+e2c6648
* Java Version:
* Elasticsearch Version:
* MongoDB Version:
* Operating System: Ubuntu 11.0.17 on Linux 5.15.0-53-generic
* Browser version: latest MSE

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.