The filtered content is inconsistent with the configuration.

[lujiang-wed]

That is my rule:

name: ****_system_error_202306121005

type: frequency

index: ****_app_log-*

num_events: 1

timeframe:
  minutes: 5

filter:
\- query:
    query_string:
        query: "level: ERROR and message: *exception"

---

It gets the right result most of the time, but occasionally it matches something wrong, such as:

****_system_error_202306121005

At least 1 events occurred between 2023-06-16 09:58  and 2023-06-16 10:03 

@timestamp: 2023-06-16T02:03:23.512Z
@version: 1
_id: -IrxwYgBGTWEaCRSkRor
_index: ****_app_log-2023.24
_type: _doc
datetime: 2023-06-16 10:03:23.512
fields: {
    "logtype": "app"
}
host: {
    "name": "****"
}
level: DEBUG
log: {
    "file": {
        "path": "/opt/app_logs/****/app.log"
    }
}
message: 2023-06-16 10:03:23.512 [DubboServerHandler-dubbo-k8s-qas.*.io:30304-thread-197] DEBUG selectSysConfig  - ==>  Preparing: select * from SYS_CONFIG where TYPE_CODE = ? AND ENABLED = 1;
num_hits: 157
num_matches: 157

[jertel]

and should be capitalized to AND in your query.