Graylog2 / Graylog2/graylog2-server

"OR NOT" in query is not returning any message

Open
#5,173 3 comments 0 reactions 0 assignees View on GitHub
search triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
Searching with query "field1:value1 OR NOT field1:value1" in the Web interface should return all the messages.

As defined in the documentation (http://docs.graylog.org/en/2.4/pages/queries.html):
![image](https://user-images.githubusercontent.com/29234693/46464740-5bf4f680-c7c7-11e8-9f34-b485b2013bff.png)

## Current Behavior
Searching with query "field1:value1 OR NOT field1:value1" in the Web interface returns no message.
But searching with query "field1:value1 OR (NOT field1:value1)" in the Web interface is working: all the messages are returned.

## Possible Solution
Fix the search.

## Steps to Reproduce (for bugs)
1. Graylog contains some messages, with field1
2. Search with query "field1:value1 OR (NOT field1:value1)" in the Web interface => returns all the message (OK)
3. Search with query "field1:value1 OR NOT field1:value1" in the Web interface => returns no message (KO)

## Context
I discovered this issue using Graylog in my company (I'm the administrator).

## Your Environment
* Graylog Version: 2.4.6+ceaa7e4, codename Wildwuchs
* JVM: Oracle Corporation 1.8.0_172 on Linux 3.13.0-153-generic
* Elasticsearch Version: Version: 5.6.3 (provided with Graylog AMI)
* MongoDB Version: v3.4.9 (provided with Graylog AMI)
* Operating System: Ubuntu on AWS (Linux graylog 3.13.0-153-generic #203-Ubuntu SMP Thu Jun 14 08:52:28 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux)
* Browser version: Firefox, on a Windows PC in a business environment (proxy + firewall + security tools ...)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.