search

SafeAF / enterprise-log-search-and-archive

Automatically exported from code.google.com/p/enterprise-log-search-and-archive
0 stars 0 forks source link

Log display exception when searching logs with '+uri="/"' as a keyword. #83

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1.Got exception when searching logs with '+uri="/"' as a keyword. Please see 
the attached img.
2.
3.

What is the expected output? What do you see instead?

What version of the product are you using? On what operating system?

Not sure what version i am using. 

OS:sles11sp1

Please provide any additional information below.

Original issue reported on code.google.com by Laurel.W...@gmail.com on 29 Oct 2012 at 3:43

Attachments:

GoogleCodeExporter commented 9 years ago 
Issue 82 has been merged into this issue.

Original comment by mchol...@gmail.com on 29 Oct 2012 at 3:54

GoogleCodeExporter commented 9 years ago 
Your search will effectively run without the term +uri:"/" because the slash 
"/" is not an indexed character.  When using the default ELSA configuration, 
Sphinx will treat non-alphanumeric characters as word breaks, so a search for 
slash will not get any hits, because it will not be a keyword.  So, the search 
in your example just looked for tomcat logs with no referrer and a given srcip 
from a given host and disregarded the URI of slash.

I will add code to at least warn if a term ends up being completely removed.

If you want to be able to search for a URI with just slash, you can go into 
archive mode by switching the "Index" button to "Archive."  The search will be 
quite slow, however.

Another alternative is to edit the sphinx.conf file on each log node and add in 
a blended_chars config statement to the "temporary" and "permanent" index 
templates.  Docs on the blended_chars config is available here: 
http://sphinxsearch.com/docs/current.html#conf-blend-chars .  However, a small 
ELSA change will also be needed to enable that, so let me know if you want to 
go that route as I'll have to make a small code update so you can configure 
ELSA to parse the queries with those blended chars correctly.

Original comment by mchol...@gmail.com on 29 Oct 2012 at 4:55

GoogleCodeExporter commented 9 years ago 
Warning added in rev 492.

Original comment by mchol...@gmail.com on 29 Oct 2012 at 5:29