用法：field_name: /regular expression/
測(cè)試1：message: /.*Exception*/
一看結(jié)果為空，這是怎么回事呢？
因?yàn)?graylog 的 elasticsearch analyzer 把字段（message、full_message令宿、source）的值都轉(zhuǎn)換為小寫了拙寡，所以搜索時(shí)字段值全部使用小寫匹配即可。
The “standard” analyzer of Elasticsearch preprocesses the message fields before indexing them. Among other things, it converts the messages to lowercase.
See https://www.elastic.co/guide/en/elasticsearch/reference/5.6/analysis-standard-analyzer.html for details about the “standard” analyzer.
By default, Graylog creates an index mapping which will instruct Elasticsearch to analyze the “message”, “full_message”, and “source” fields. Other fields are not automatically analyzed.
You can change the analyzer which Elasticsearch is applying to a message field by creating your own custom index mapping:
http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings
測(cè)試2：message: /.*exception*/ （字段值全部使用小寫匹配）
可以看到出現(xiàn)匹配結(jié)果了惯吕。
參考：https://community.graylog.org/t/wildcard-search-question/167/9
