search

graylog-labs / graylog2-web-interface

[DEPRECATED]
https://www.graylog.org/
611 stars 174 forks source link

Query generation in Web-Interface buggy? #1544

Closed SEAIT closed 9 years ago

SEAIT commented 9 years ago

Hi, We entered a search for a specific field, the search was successful. We entered another search pattern and received no result. Promis the Value is in the DB. We looked at the Query source and noticed that the search value was buggy. Here the samples: This query was successful...D_msgid:%asa-4-* ( Cisco Log Message ID ) This query failed:..................D_msgid:%ace-4-* ( see attached image for query source) This query was successful...D_msgid:%\ace-4-*
This query failed...................D_msgid:%bcd-4-*
This query was successful...D_msgid:%\bcd-4-*
This query was successful...D_msgid:%zel-4-*

Version is 1.1.5 also seen under 1.1.4 Any ideas?

bcd_esc_b_success-graylog - search zel_success-graylog - search bcd_failed-graylog - search asa_success-graylog - search ace_esc_a_success-graylog - search ace_failed-graylog - search

edmundoa commented 9 years ago

Hi,

The issue you are experiencing is due to URL encoding, similar to the one described in #1523. At the moment, search requests are being sent as a GET parameter, meaning that they need to be encoded in URL format and then decoded in the server to get the actual query. There is apparently a problem encoding those percentage signs in your query, and that is generating a wrong query in the server.

As a workaround until we fix the issue, I suggest that you avoid using percentages in your queries, as Elasticsearch will ignore them anyway, as far as I know.