Search in Graylog for "[error]"

Question

I have some trouble with searching in the Graylog Webinterface:

Currently i have the following query:

message: "\[error\]"

But the query returns also messages like this:

 [warn] Error while parsing: %MatchError

Any idea how to search for all entries beginning with "[error]" ?

Answer 1

You probably have to create a custom Elasticsearch index mapping and use another analyzer for the message field if you want to include special characters such as [ or ] in your queries.

References:

• http://docs.graylog.org/en/2.3/pages/configuration/elasticsearch.html#custom-index-mappings
• https://www.elastic.co/guide/en/elasticsearch/reference/5.6/analysis-analyzers.html