diff --git a/lib/logstorage/parser.go b/lib/logstorage/parser.go index 2ec250030f..ca4dcc45bf 100644 --- a/lib/logstorage/parser.go +++ b/lib/logstorage/parser.go @@ -840,7 +840,7 @@ func parseGenericFilter(lex *lexer, fieldName string) (filter, error) { } return f, nil case lex.isKeyword("("): - if !lex.isSkippedSpace && !lex.isPrevToken("", ":", "(", "!", "not") { + if !lex.isSkippedSpace && !lex.isPrevToken("", ":", "(", "!", "-", "not") { return nil, fmt.Errorf("missing whitespace before the search word %q", lex.prevToken) } return parseParensFilter(lex, fieldName) diff --git a/lib/logstorage/parser_test.go b/lib/logstorage/parser_test.go index 3593477047..36cf65da6c 100644 --- a/lib/logstorage/parser_test.go +++ b/lib/logstorage/parser_test.go @@ -646,6 +646,8 @@ func TestParseQuerySuccess(t *testing.T) { f(`not(foo)`, `!foo`) f(`not (foo)`, `!foo`) f(`not ( foo or bar )`, `!(foo or bar)`) + f(`!(foo or bar)`, `!(foo or bar)`) + f(`-(foo or bar)`, `!(foo or bar)`) f(`foo:!""`, `!foo:""`) f("_msg:foo", "foo") f("'foo:bar'", `"foo:bar"`)