# Alert - Rules query\_string not working

**URL:** <https://discuss.elastic.co/t/alert-rules-query-string-not-working/287360>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [October 21, 2021, 7:37pm UTC](https://discuss.elastic.co/t/alert-rules-query-string-not-working/287360 "2021-10-21T19:37:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fredrick.bb](https://avatars.discourse-cdn.com/v4/letter/f/7bcc69/32.png) [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\
**Post date:** [October 21, 2021, 7:37pm UTC](https://discuss.elastic.co/t/alert-rules-query-string-not-working/287360/1 "2021-10-21T19:37:09Z")

</div>

Hello,

I have a log as json string like below and that has been parsed as jsonparsor and stored in Elasticsearch

```auto
{
  "_index": "some index",
  "fields": {
  "many keys" : " values",
    "class.keyword": [
      "org.apache.kafka.streams.KafkaStreams"
    ],
    "class": [
      "org.apache.kafka.streams.KafkaStreams"
    ],
    "message": [
      "stream-client [App-01ce8fb0-4432-4998-85c4-bae921f925fa] State transition from RUNNING to ERROR"
    ]
  }
}

```

I need to search in the query as  
class : "org.apache.kafka.streams.KafkaStreams" and message : "\*State transition from RUNNING to ERROR" should occur minimum once to trigger an alert.

I tried query\_string like below but nothing worked

```auto
{
  "query": {
  	"query_string": {
  		"query": "*State transition from RUNNING to ERROR",
  		"fields": ["message"],
  		"minimum_should_match": 1
  	}
  }
}

Also
{
  "query": {
  	"query_string": {
  		"query": "(class:org.apache.kafka.streams.KafkaStreams) AND (message:*State transition from RUNNING to ERROR)",
               "minimum_should_match": 1
  	},
     	}
}

```

Can I get a guidance ? which clause is the best for my scenario?

Thanks in advance for your suggestion  
Fredrick

---

<div class="post-metadata">

**Author:** ![fredrick.bb](https://avatars.discourse-cdn.com/v4/letter/f/7bcc69/32.png) [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\
**Post date:** [October 27, 2021, 3:43pm UTC](https://discuss.elastic.co/t/alert-rules-query-string-not-working/287360/2 "2021-10-27T15:43:23Z")

</div>

@kibanaquery @HereToHelp I've been waiting since Oct 21.. Can anyone take a look and respond?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2021, 3:43pm UTC](https://discuss.elastic.co/t/alert-rules-query-string-not-working/287360/3 "2021-11-24T15:43:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.