GRAYLOG - Chapter 9, Exercise 2 Solution
==========================================================
Why a Generic Keyword Search on Scout Returns the Wrong Thing

PROBLEM
-------
A colleague searches scout's logs for the free-text keyword "manager"
hoping to find code-path errors related to a manager service, but gets
thousands of unrelated results. Using this chapter's own material,
explain what's most likely happening and how they should rewrite the
search.

SOLUTION
--------
This chapter established that scout and search log real candidate and
resume content as part of their own normal operation, so a generic
free-text keyword is far more likely to match that CONTENT - candidate
job titles, resume text, and similar - than any actual code path or
error condition. "Manager" is an extremely common real job title, which
explains the thousands of unrelated results directly.

The chapter's own real fix: scope with service and daxtraResource
first, and prefer exception/status-shaped structured queries over
generic free-text keywords on these two services specifically. If the
real goal is finding errors related to a manager-named component, a
structured query like:

    service:scout AND level:(2 OR 3)

is far more likely to surface genuine code-path problems than searching
the free-text word "manager" ever would.

ANSWER: The keyword "manager" is matching real candidate resume/job-
title content, not code paths, because scout logs candidate-related
free text extensively. The fix is to scope with service/daxtraResource
and use a structured, severity- or status-based query instead of a
generic free-text keyword search.

----
WHY THIS WORKS AS AN ANSWER

This is a direct application of this chapter's own stated real gotcha,
which itself echoes Chapter 6's own candidateId finding - both point to
the same underlying real cause: scout and search carry an unusually
large volume of real candidate-related free text, which behaves very
differently from a typical application log line.