I'd like to setup a tag that is restrictive (AND) in its query rather than inclusive (OR). For example, if you specify a tag with many field value pairs like this:
index=foobar
host=10.17.41.1
host=10.17.41.2
A search using this tag will look for events in index=foobar OR host=10.17.41.1 OR host=10.17.41.2 , but I want the search to look for events in index=foobar AND (host=10.17.41.1 OR host=10.17.41.2) . I tried explicitly setting the following as a tag but no results were returned:
index=foobar AND (host=10.17.41.1 OR host=10.17.41.2)
... View more