Hello @sohailmeer:
message: “ERROR|FAILED|WARN” is searching for that literal string in the body. Is that what you want? If not, then I think what you want is grouping.
source:“xyz” AND log_file_path:"/var/log/messages" AND (message:“ERROR” OR message:“FAILED” OR message:“WARN”)
https://docs.graylog.org/en/3.3/pages/searching/query_language.html