search

graylog-labs / graylog2-web-interface

[DEPRECATED]
https://www.graylog.org/
611 stars 174 forks source link

Quick Values are not Case Sensitive #1680

Closed gruselglatz closed 8 years ago

gruselglatz commented 8 years ago

I've some source fields that contain strings like these:

dc01 DC02 dc01.domain.local DC02.domain.local

If i make a Quick Value over the source field, i get all in lower Case.

joschi commented 8 years ago

That's a side effect of the source message field being analyzed to enable advances search queries for that field (see https://www.elastic.co/guide/en/elasticsearch/guide/current/analysis-intro.html#id-1.4.8.16.7.4.1.2.1.1). If you don't want the source field to be analyzed, you'd need to create a custom mapping and use it as an index template (see https://www.elastic.co/guide/en/elasticsearch/reference/1.7/indices-templates.html).