query string has error?

[lagougou]

name: Beep_payment_error_monitor
type: frequency
index: filebeat-*
num_events: 10
aggregation:
minutes: 5
timeframe:
minutes: 5
buffer_time:
minutes: 10
query_delay:
hours: 0
query_key:

• message
  filter:
• query:
  • query_string:
    query: "message: kubernetes.container.name: payment-api AND kubernetes.namespace: pro"
    alert:
• command
  command: /usr/bin/python3 /root/elastalert/send_message.py
  pipe_alert_text: true
  alert_subject: 'Alert: System {0} occurred {1} times.'
  alert_subject_args:
• '@timestamp'
• num_hits
  alert_text: >-
  {1} Alert: Payment-api Uncaught Exception {2} times, You can access all of error log on
  Kibana: {0} storehub alert dashboard
  alert_text_args:
• kibana_url
• '@timestamp'
• num_hits
  kibana_url: >-
  https://kibana.mymyhub.com/app/kibana#/dashboard/4c8cbec0-f188-11ea-ade3-3fb45f1c9de3
  timestamp_field: '@timestamp'

this is my rule file
i migrate the data from elasticsearch to aws elasticsearch
before the query string is ok, but now the query is with exception RequestError(400, 'x_content_parse_exception', '[1:143] [bool] failed to parse field [must]')