NOTE:
SSB only indexes the first 59 characters of every name-value pair (parameter). This
has two consequences:
l
If the parameter is longer than 59 characters, an exact search might deliver
multiple, imprecise results.
Consider the following example. If the parameter is:
.sdata.security.uid=2011-12-08T12:32:25.024+01:00-hostname-12345
SSB indexes it only as:
.sdata.security.uid=2011-12-08T12:32:25.024+01:00-hostname-
This corresponds to the first 59 characters. As a result, searching for:
nvpair:.sdata.security.uid=2011-12-08T12:32:25.024+01:00-hostname-12345
returns all log messages that contain:
.sdata.security.uid=2011-12-08T12:32:25.024+01:00-hostname-
l
Using wildcards might lead to the omission of certain messages from the
search results.
Using the same example as above, searching for the value:
nvpair:*=2011-12-08T12:32:25.024+01:00-hostname-12345
does not return any results (as the
12345
part was not indexed). Instead, you
have to search for:
nvpair:*=2011-12-08T12:32:25.024+01:00-hostname-*
This, as explained above, might find multiple results.
Search performance tips
To decrease the load on SSB when searching and receive your search results faster, note
the following points.
l
Use as small a time range as possible
l
Prefer AND instead of OR
l
Avoid unneeded wildcard characters, such as
*
and
?
l
Use wildcard characters at the end of the tokens if possible
Searching encrypted logspaces
By default, you cannot browse encrypted logstores from the SSB web interface, because
the required decryption keys are not available on SSB. To make browsing and searching
encrypted logstores possible, SSB provides the following options:
SSB 5.3.0 User Guide
Searching log messages
27
