Can you try wrapping the query in triple quotes, similar to this example.
GET _search
{
"query": {
"query_string": {
"query": """message:\"com.microsoft.sqlserver.jdbc.SQLServerException\"
AND level: DEBUG
AND threadname: xyz
AND @timestamp:(>=now-1h AND <now)"""
}
},
"aggs": {
"application": {
"terms": {
"field": "kubernetes.labels.app.keyword"
}
}
}
}