Watcher Alert with multi match

[vaibhav.ubale]

Hi Team ,

I am New to community, I want to set up the watcher alert on the logs with messages like following
"message: The user has selected account 84900-1 has no limit left"
Where 84900 is account type and 1 is sub type.
Can we set up the alert based on the multi match
Following is something i am trying to create but is not working.

"must": {
                "query_string": {
                  "analyze_wildcard": true,
                  "default_field": "*",
                  "query": "message: \*"The user has selected account 84900-* has no limit left*\""
                }

Can some one help?

[Ayush_Mathur]

Hi @vaibhav.ubale , welcome to the community !
There are few options or ways to define the search query to get intended result. Since you just want to search for a substring in your message field in the same order, may be try match_phrase_prefix query with 84900- in message field.

Please refer to Elastic documentation: Match phrase prefix query | Elasticsearch Guide [8.6] | Elastic

[vaibhav.ubale]

Hi Ayush ,

Thanks for your suggestion.
It worked well . I appreciate your help and suggestion here.