Graylog2 / Graylog2/graylog2-server
Wildcard search failed while the search string contains Uppercase for searching fields
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
The searching function of Graylog2 should be able to search string using wildcard search
But in my case (Graylog2.2), for the field called "Event" contains "UserLogoutSessionEvent"
I am not able to search by using the Syntax:
Event:User*
Event:*Logout*
While the following query seems work:
Event:?ser?ogout*
Event:*
Event:UserLogoutSessionEvent
## Expected Behavior
Searching should return matched result whatever the search criteria contain Uppercase or Lowercase Character, or Both with the use of wildcard search
For example, for the field called "Event" contains "UserLogoutSessionEvent" should be able to search by using the following query:
Event:User*
Event:*Logout*
Event:User?ogout*
Event:userlogout*
(Whatever the query contains Uppercase)
## Current Behavior
Will return nothing if the query String contains Uppercase character, for example:
Event:User?ogout*
**Update
1. This behavior will not happen if the field are stored with only lowercase letter, for example:
Search Event:UserLogin* on the "Event" field that contains userloginsessionevent will not trigger this behavior
## Possible Solution
The cause of this behavior is currently unknown so we need attention here
## Steps to Reproduce (for bugs)
1. Create a record with one of the field contains Uppercase Character
2. Search the field that contain Uppercase Character together with wildcard search
3. Nothing return from the result
4.
## Context
Unable to search if any of the field contains Uppercase within the query string
## Your Environment
* Graylog Version:Graylog v2.2.3+7adc951
* Elasticsearch Version: v2.2.4
* MongoDB Version: v2.6.10
* Operating System: Ubuntu 16.04.2 LTS
* Browser version: Chrome Version 58.0.3029.110
Contributor guide
Assessment
This issue has not been assessed yet.