better query:
@message:"Exit code: 5" AND @message:" sudo cinder-rootwrap /etc/cinder/rootwrap.conf lvremove -f" AND @fields.filename:"logs/screen-c-vol.txt" AND @fields.build_status:"FAILURE"
better query:
@message:"Exit code: 5" AND @message:" sudo cinder-rootwrap /etc/cinder/ rootwrap. conf lvremove -f" AND @fields. filename: "logs/screen- c-vol.txt" AND @fields. build_status: "FAILURE"