Wildcard search failed while the search string contains Uppercase for searching fields

[ken013194]

The searching function of Graylog2 should be able to search string using wildcard search
But in my case (Graylog2.2), for the field called "Event" contains "UserLogoutSessionEvent"
I am not able to search by using the Syntax:
Event:User*
Event:Logout

While the following query seems work:
Event:?ser?ogout*
Event:*
Event:UserLogoutSessionEvent

Expected Behavior

Searching should return matched result whatever the search criteria contain Uppercase or Lowercase Character, or Both with the use of wildcard search
For example, for the field called "Event" contains "UserLogoutSessionEvent" should be able to search by using the following query:
Event:User*
Event:Logout
Event:User?ogout*
Event:userlogout*

(Whatever the query contains Uppercase)

Current Behavior

Will return nothing if the query String contains Uppercase character, for example:
Event:User?ogout*

**Update

1. This behavior will not happen if the field are stored with only lowercase letter, for example:
   Search Event:UserLogin* on the "Event" field that contains userloginsessionevent will not trigger this behavior

Possible Solution

The cause of this behavior is currently unknown so we need attention here

Steps to Reproduce (for bugs)

1. Create a record with one of the field contains Uppercase Character
2. Search the field that contain Uppercase Character together with wildcard search
3. Nothing return from the result

Context

Unable to search if any of the field contains Uppercase within the query string

Your Environment

• Graylog Version:Graylog v2.2.3+7adc951
• Elasticsearch Version: v2.2.4
• MongoDB Version: v2.6.10
• Operating System: Ubuntu 16.04.2 LTS
• Browser version: Chrome Version 58.0.3029.110

[ghost]

See #706.

[jalogisch]

The Lucene Query Language should be documented better - this is not a bug, but need to be described better.

[vnyshva]

I have some similar issue.
If i try to search logs starting with ERROR [date] using message:/^ERROR/
This gives no result.