[Feature] Support for finding text anywhere in the message

[chatziko]

Feature Description

Logward's full text search is certainly a killer feature!

One area for improvement is the use of tsvector indexes, which is tailored to "linguistic" search. If a message has the word failed it will be found when searching for fail, but not when searching for aile.

It would be awesome if the possibility of searching anywhere in the message was offered by logward. Maybe using pg_trgm or something else.

Problem/Use Case

When digging into logs we very often want to find foo anywhere in the message, eg I searched for bluez and failed to find the message spa.bluez5.native which is clearly relevant for my search!

Proposed Solution

Search for strings anywhere in the message, either by default or as an option.

Alternatives Considered

Implementation Details (Optional)

pg_trgm could be an option, I don't know how large the index would be.

Even unindexed search would be welcome (with a warning that it might be slow).

Priority

• Critical - Blocking my usage of LogWard
• High - Would significantly improve my workflow
• Medium - Nice to have
• Low - Minor enhancement

Target Users

• DevOps Engineers
• Developers
• Security/SIEM Users
• System Administrators
• All Users

Additional Context

Contribution

• I would like to work on implementing this feature

[Polliog]

Thanks for the issue and great idea. Before actually implementing it, I would like to run some tests to understand the weight of the index on many logs (at least 5 million). Although this is not really a problem in itself, since it could be an optional feature anyway.

So it could be done, pg_trgm as an option and a full text search without pg_trgm but with a warning, as you said.

I'll try to include it in version 0.4, which is scheduled for release in January.

[Polliog]

Pre released in 0.4.0-rc1