Discect rule with a "+" sign in the message, can't escape it

[UPPERCASE]

Thanks for your reply! I found the issue already, there was another ingest pipeline that split the lines the wrong way. This caused the confusion.