How to find all SIEM rules where field "timestampOverride" is not equal to "event.ingested"?

[dsv (Serg)]

Hey everyone
8.12.0

Trying to find SIEM detection rules where field "timestampOverride" is not equal to "event.ingested"

GET kbn:/api/alerting/rules/_find?search_fields=params.timestampOverride&search=event.ingested
is worked.

How to find all other rules where field "timestampOverride" is not equal to "event.ingested"?

The simple filter also works

GET kbn:/api/alerting/rules/_find?filter=alert.attributes.params.timestampOverride:event.ingested

But

GET kbn:/api/alerting/rules/_find?filter
 { "bool": 
    { "must_not": [
      { "term":
        {"params.timestampOverride": "event.ingested"}
      }
    ]
    }
 }

shows all rules (not filtered) as a JSON

[dsv (Serg)]

Any ideas?