Elastalert rule for different messages

Question

Want to find and alert events by this rule:

filter:
 - query:
      query_string:
        query: "message: *tried to login* OR message: *invalid username or password* OR message: *incorrect login attempts* OR message: *Couldn't find user named*"

i.e I want alerting when any of message appear in Elastic index. But it doesn't work. How I can correctly describe this query section?

Answer 1

Solved by this:

filter:
 - query:
      query_string:
        query: "message:\"tried to login\" OR message:\"Invalid username or password\""