Do backslashes (/) interfere with a term filter? (Check my filter)

[roman-tasi]

My rule isn't getting any hits despite me confirming that the logs it should be hitting on are in Kibana. I am wondering if it is due to the backslashes in the term. Here is my filter:

filter:
- term:
    system.filesystem.device_name: "/dev/mapper/centos_templatecentos7-root"

So what do you think the issue/solution is?

[jertel]

There's not enough information provided to offer you a solution. I suggest simplifying your rule until you get a hit, and then add more complexity back until it stops finding data.

[roman-tasi]

My rule is already as simple as it can be, it only has one term filter... how can I reduce it any more?

[jertel]

Simplify it to a term value without slashes?
Simplify it to a term key without periods?
Simplify the index pattern to "*"?

A quick search of other discussions will show that my response to these questions "why isn't my rule working?" is to enable debug mode so you can see the request going to Elasticsearch and then the response coming back. Then compare those two with the same request and response pairs that Kibana sends and receives (these are visible in the Kibana UI).