[query_elasticsearch_octobus_vmdown]
QueryIntervalSecs = 300
QueryTimeoutSecs = 150
QueryIndices = c0001_log-*
QueryOnMissing = drop
LabelsFromHits = [ "@timestamp", "node.nodename", "node.building_block", "cloud.instance.id", "cloud.instance.name" ]
QueryJson = {
    "query": {
      "bool": {
        "must": [
          { "exists": { "field": "node.nodename" }},
          { "match_phrase": { "message": "An operation required the virtual machine to quiesce and the virtual machine was unable to continue running." }}
        ],
        "filter": [
          { "range": { "@timestamp": { "gte": "now-1h" }}}
        ],
        "must_not": [
          { "match_phrase": { "logger_name": "tars" }}
        ]
      }
    }
  }

[query_elasticsearch_octobus_vmdown]
QueryIntervalSecs = 300
QueryTimeoutSecs = 150
QueryIndices = c0001_log-*
QueryOnMissing = drop
LabelsFromHits = [ "@timestamp", "node.nodename", "node.building_block", "cloud.instance.id", "cloud.instance.name" ]
QueryJson = {
    "query": {
      "bool": {
        "must": [
          { "exists": { "field": "node.nodename" }},
          { "match_phrase": { "message": "An operation required the virtual machine to quiesce and the virtual machine was unable to continue running." }}
        ],
        "filter": [
          { "range": { "@timestamp": { "gte": "now-1h" }}}
        ],
        "must_not": [
          { "match_phrase": { "message": "vpxd" }},
          { "match_phrase": { "logger_name": "tars" }}
        ]
      }
    }
  }

Exclude vcsa logs from query
[elastic-query-exporter] Exclude vcsa logs from query
