Skip to content
rurounijones edited this page Dec 22, 2011 · 6 revisions

FAQ

How do I send logs from Windows?

Some options:

Why does wildcard search only work on lowercase content?

By default ElasticSearch uses an analyzer on fields that is case sensitive. There is also a setting in ElasticSearch that makes the search terms lower case. When using wildcard searches this means you don't get any hits since the lowercase search doesn't match the upper/mixed case content. You can apply a template in ElasticSearch that creates a custom analyzer (easier than it sounds) that makes it case-insensitive. This is the important part of it:

"analysis" : {
  "analyzer" : {
    "keylowercase" : { "type" : "custom", "tokenizer" : "keyword", "filter" : "lowercase" }
  }
}

and then use that on the fields you need:

"trackingid" : { "type" : "string", "analyzer" : "keylowercase" }

Link to LOGSTASH-235 in Jira for more details

Clone this wiki locally