[query_elasticsearch_octobus_esxi_nic_error]
QueryOnMissing = drop
QueryJson =
    {
        "aggs": {
            "hostsystem": {
                "terms": {
                    "field": "node.nodename.keyword"
                }
            }
        },
        "query": {
            "bool": {
                "must": [
                    {
                        "exists": {
                            "field": "node.nodename"
                        }
                    }
                ],
                "filter": [
                    {
                        "bool": {
                            "should": [
                                {
                                    "bool": {
                                        "should": [
                                            {
                                                "match_phrase": {
                                                    "message": "enic_uplink_reset"
                                                }
                                            }
                                        ],
                                        "minimum_should_match": 1
                                    }
                                },
                                {
                                    "bool": {
                                        "should": [
                                            {
                                                "match_phrase": {
                                                    "message": "wq is full"
                                                }
                                            }
                                        ],
                                        "minimum_should_match": 1
                                    }
                                },
                                {
                                    "bool": {
                                        "should": [
                                            {
                                                "match_phrase": {
                                                    "message": "Timed out devcmd"
                                                }
                                            }
                                        ],
                                        "minimum_should_match": 1
                                    }
                                }
                            ],
                            "minimum_should_match": 1
                        }
                    },
                    {
                        "range": {
                            "@timestamp": {
                                "gte": "now-1h"
                            }
                        }
                    }
                ]
            }
        }
    }

[query_elasticsearch_octobus_esxi_nic_error]
QueryOnMissing = drop
QueryJson =
    {
        "aggs": {
            "hostsystem": {
                "terms": {
                    "field": "node.nodename.keyword"
                }
            }
        },
        "query": {
            "bool": {
                "must": [
                    {
                        "exists": {
                            "field": "node.nodename"
                        }
                    }
                ],
                "filter": [
                    {
                        "bool": {
                            "should": [
                                {
                                    "bool": {
                                        "should": [
                                            {
                                                "match_phrase": {
                                                    "syslog_message": "enic_uplink_reset"
                                                }
                                            }
                                        ],
                                        "minimum_should_match": 1
                                    }
                                },
                                {
                                    "bool": {
                                        "should": [
                                            {
                                                "match_phrase": {
                                                    "syslog_message": "wq is full"
                                                }
                                            }
                                        ],
                                        "minimum_should_match": 1
                                    }
                                },
                                {
                                    "bool": {
                                        "should": [
                                            {
                                                "match_phrase": {
                                                    "syslog_message": "Timed out devcmd"
                                                }
                                            }
                                        ],
                                        "minimum_should_match": 1
                                    }
                                }
                            ],
                            "minimum_should_match": 1
                        }
                    },
                    {
                        "range": {
                            "@timestamp": {
                                "gte": "now-1h"
                            }
                        }
                    }
                ]
            }
        }
    }

Use field indexed with standard analyzer
[octobus-query-exporter] Use field indexed with standard analyzer
