Hi ,
I am using the following query to identify log entries having the message "DeviceStatus changed to Idle" within a period. But the query also returns the following messages
"Module State is changed to idle ModuleName : PA Previous State Idle"
"Module State is changed to idle ModuleName : PM2 Previous State Idle"
{
"query": {
"bool":{
"must":[
{ "match":{
"Message":"DeviceStatus changed to Idle"
}
},
{ "range":{
"@timestamp":{
"gte":"2019-08-08T13:42:39.307Z",
"lt":"2019-08-08T13:42:40.430Z"
}
}
}
]
}
}
}
What changes should be made to get matching records?