Firewall log live view - at least one type of query as template doesn't work

[pseudonym3k]

Minor bug?

Firewall -> Logs - > Live View -> Templates. I have a few templates saved from prior versions (25.7 and prior) and these work fine.

After upgrading to 26.1, I entered criteria for a template and got my expected result list. I saved it as a new template.

The saved template does not bring up any result. If I reenter criteria and apply it to the log, I get a result.

Sample criteria:

Change "action" in dropdown to "address"
Change "contains" in dropdown to "is"
Enter some address in search box that has log entries - I entered 192.168.1.9

Applying the above criteria brings up several records. I save it as a template, leave the firewall log and display some other page like the Dashboard. Then I come back to the firewall log and choose the new template. Nothing is displayed.

[julsssark]

I created a new criteria using Safari and it worked correctly. I am running 26.1.1. Maybe a browser issue? Is auto-refresh enabled?

[pseudonym3k]

I've used multiple machines and multiple browsers. Auto refresh is on.

Firewall just updated to 26.1.1 and I still have the same problem.

Did you try the specific example I gave? It looks like that might be the only one that doesn't work. I tried a query src_port contains and that one worked.

I tried the above specific criteria (address, is, <value>) with multiple LAN and public IPs and none of them worked for me.

[julsssark]

You are correct. I am sorry, I should have tried it with your exact example. I see the same behavior you do. It looks like a bug. I tried a few different variations. The "address" field with "contains" or "is", generates the problem but using "is not" or "does not contain" works correctly. I suggest filing a bug report: https://github.com/opnsense/core/issues

[pseudonym3k]

No worries! Thank you for confirming the behavior. I'll go see about that bug report, thanks!