GRAYLOG - Chapter 6, Exercise 2 Solution
==========================================================
Searching for a Candidate ID Correctly

PROBLEM
-------
You need to find every log line mentioning candidate ID cand-88213.
Using this chapter's own material, explain why candidateId:cand-88213
is the wrong query to start with, and write the query you'd actually
use instead.

SOLUTION
--------
This chapter's own warn-box established that candidateId is usually NOT
a structured field in most real services - it typically appears only as
free text embedded within a log message. Searching
candidateId:cand-88213 as a field will usually miss real matches
entirely, since there's no actual structured field of that name for
Graylog to match against in most services.

The chapter's own real fix: search the ID as plain, unquoted-field free
text instead:

    cand-88213

ANSWER: candidateId:cand-88213 is the wrong starting query because
candidateId usually isn't a real structured field. The query to actually
use is just the ID itself as free text: cand-88213

----
WHY THIS WORKS AS AN ANSWER

This directly applies the chapter's own stated real gotcha. Free-text
search still finds the ID wherever it appears in a message body,
regardless of whether any particular service happens to expose it as a
structured field - it's a genuinely safer default for candidateId
specifically, since assuming it behaves like the other ID-shaped fields
from Chapter 4 leads to silently missed results.