Graylog2 / Graylog2/graylog2-server

Wildcard search failed while the search string contains Uppercase for searching fields

Open
#3,845 3 comments 0 reactions 0 assignees View on GitHub
documentation
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

The searching function of Graylog2 should be able to search string using wildcard search
But in my case (Graylog2.2), for the field called "Event" contains "UserLogoutSessionEvent"
I am not able to search by using the Syntax:
Event:User*
Event:*Logout*

While the following query seems work:
Event:?ser?ogout*
Event:*
Event:UserLogoutSessionEvent

## Expected Behavior
Searching should return matched result whatever the search criteria contain Uppercase or Lowercase Character, or Both with the use of wildcard search
For example, for the field called "Event" contains "UserLogoutSessionEvent" should be able to search by using the following query:
Event:User*
Event:*Logout*
Event:User?ogout*
Event:userlogout*

(Whatever the query contains Uppercase)

## Current Behavior
Will return nothing if the query String contains Uppercase character, for example:
Event:User?ogout*

**Update
1. This behavior will not happen if the field are stored with only lowercase letter, for example:
Search Event:UserLogin* on the "Event" field that contains userloginsessionevent will not trigger this behavior

## Possible Solution
The cause of this behavior is currently unknown so we need attention here

## Steps to Reproduce (for bugs)
1. Create a record with one of the field contains Uppercase Character
2. Search the field that contain Uppercase Character together with wildcard search
3. Nothing return from the result
4.

## Context
Unable to search if any of the field contains Uppercase within the query string
## Your Environment

* Graylog Version:Graylog v2.2.3+7adc951
* Elasticsearch Version: v2.2.4
* MongoDB Version: v2.6.10
* Operating System: Ubuntu 16.04.2 LTS
* Browser version: Chrome Version 58.0.3029.110

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.