Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot perform searches that only contain "NOT"s #5

Open
JackBister opened this issue Jan 9, 2021 · 0 comments
Open

Cannot perform searches that only contain "NOT"s #5

JackBister opened this issue Jan 9, 2021 · 0 comments
Labels
bug Something isn't working
Projects

Comments

@JackBister
Copy link
Owner

For example you cannot search for source!=*access*.

This seems to be a limitation in SQLite FTS, when running this query:

SELECT
	e.id,
	e.host,
	e.source,
	e.timestamp,
	r.raw
FROM
	Events e
INNER JOIN EventRaws r ON
	r.rowid = e.id
WHERE
	e.id < 748246
	AND e.timestamp >= '2021-01-09 18:10:59.6623322 +0100 CET m=-886.364488199'
	AND EventRaws MATCH 'NOT source:*access* '
ORDER BY
	e.timestamp DESC,
	e.id DESC;

directly against the database I get the following error: malformed MATCH expression: [NOT source:*access* ]

I'm sure there's a way to work around it.

@JackBister JackBister added the bug Something isn't working label Jan 9, 2021
@JackBister JackBister added this to TODO in logsuck Feb 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
No open projects
Development

No branches or pull requests

1 participant