I’m trying to create a stream for this search query
identity:ams_production level: 3 AND message: 'AmsAusLiveToVodStatusShellJob Live To Vod Converting failed or deleted'
and for my stream rules I have the fallowing options;
* Field *identity* must match exactly *ams_production* * Field *level* must be smaller than *3* * Field *message* must not match exactly *'AmsAusLiveToVodStatusShellJob Live To Vod Converting failed or deleted'*
The stream is not display any of the data from the original search query under the stream. What am I missing?