Hey @ofentselogger,
Understanding how searches work when using the message/full message field is important, Opensearch is performing tokenisation that you might not be aware of. This post goes some way to explaining that
The best approach would be to parse out the msg=value into it’s own field, this field could then be searched/aggregated and would not be tokenised.