query for a quoted string

[Idam7961]

this is my current filter for a rule

filter:
- query:
    query_string:
      query: "message: error"

i would like it to be a query for this string with quotes "log.level":"info"

so i change the filter in according to the docs using the \ to escape the quotes and ":" to this:

filter:
- query:
    query_string:
      query: "message:  \"log.level\"\:\"info\""

but its not working. what should be the right syntax please?

thank you.

[jertel]

filter:
- query:
    query_string:
      query: "message: \"\\\"log.level\\\"\:\\\"info\\\"\""

Note that this is attempting to match the exact string "log.level":"info". It cannot be a substring of the message, it must be the entire, exact string in order for it to match.