How-To: Case-Insensitive Searches

By default, repository queries in LogScale are case-sensitive. However, when querying a repository, some log lines may be overlooked due to unexpected case of the text. There is a way to resolve this situation.

The wildcard() function allows for searching events using a wildcard pattern search. Using the ignoreCase parameter the search can be performed ignoring the case of the string.

For example:

logscale
wildcard(pattern="ErroR",ignoreCase=true)

Will search for the word error ignoring the case, matching Error and ERROR and other variants.

Work-Around

When searching on a particular term, to make the search case-insensitive, you can wrap the text with regex delimiters (e.g., forward-slashes) and append that with the case insensitivity modifier (i.e., the letter i). For example, to search for events containing the word, Error, you could enter this in the query box:

/ErroR/i

Notice that the text here includes atypical use of capital letters. Without the insensitivity flag, it would almost certainly return no results. But with it, it will return entries containing no capital letters, all capital letters, or only some.

Case Insensitive Searches

Figure 5. Case Insensitive Searches


This work-around resolves the problem for a single query; you'll have to use this method for each query for which you want case-insensitive queries. That may be bothersome if you do this often.

It is possible to set the default for searching repositories to case-insensitive. To do this, first do a search as shown in the example above, perhaps with the word Text like so: /Text/i. Don't worry if it yields any results.

When ready, click on Save as... near the top right corner of the User Interface. You'll be asked to give the query a name. Do so and then click the Save button.

Setting Default Query

Figure 6. Setting Default Query


Now go to the Settings tab, to the Basic Information section — it's the opening screen for Settings. At the bottom of that panel, see where it says Default Query, like in the preceding figure. Click on the pull-down menu there and select the query you just saved, to make it the default one.

After doing this, whenever you open the Search tab, you'll see that query, which will be set for case-insensitive. Then just double-click on the text contained within it and type what you actually want for search text.

To set a particular query to case-sensitive, just remove the case insensitivity modifier (i.e., the letter i) from the end. To set the default back to case-sensitive, go back to Settings and select another query or no query (i.e., the blank choice).