I need to search a paragraph of text to identify it.

[bbzcx]

message:"Found no process plan tracking data for substrate"
When I use the above method, I can search in elk

However, I will report an error when configuring rules like this in elastalert!!
filter:

• query:
  query_string:
  query: "message: "Found no process plan tracking data for substrate""

[nsano-rururu]

@bbzcx

Read the guidelines!
#11

[nsano-rururu]

https://elastalert2.readthedocs.io/en/latest/recipes/faq.html#how-to-write-a-query-filter-for-phrases-containing-spaces