GRAYLOG - Chapter 6, Exercise 1 Solution
==========================================================
Why action:sync Fails on integrations-perl

PROBLEM
-------
A colleague queries action:sync AND service:integrations-perl and gets
zero results, even though they're confident sync actions are happening
on that service right now. Using this chapter's own material, explain
the most likely cause.

SOLUTION
--------
This chapter's own warn-box established that action and integration are
structured fields specific to integrations-api ONLY, and are explicitly
NOT structured fields on integrations-perl - despite the similar-
sounding service names, the two are genuinely different codebases with
different field vocabularies.

Since integrations-perl never populates the action field at all, the
query action:sync AND service:integrations-perl is asking for two
conditions that can never both be true on that service - it will always
return zero results, regardless of whether sync activity is genuinely
happening.

ANSWER: The most likely cause is that action is not a real field on
integrations-perl at all - it's specific to integrations-api. The query
should drop the action field entirely for integrations-perl and instead
search using whichever fields that service actually supports (or search
"sync" as free text instead of as a structured field).

----
WHY THIS WORKS AS AN ANSWER

This directly applies the chapter's own explicit warning distinguishing
integrations-api from integrations-perl. The mistake is an easy one to
make precisely because the two service names look like variants of each
other - this chapter's own point in calling it out is to prevent
exactly this kind of silently-impossible query.