ElastAlert filter

[ngms17]

I am trying to use ElastAlert with Suricata.

How can I filter my rule file to alert only in logs containing "ET MALWARE"?

filter:
- query:
    query_string:
      query: "suricata.eve.alert.signature: ET MALWARE"

Using like this, I can´t get any hits because I suspect I have to put the entire ET MALWARE ...

Bu in this case, I want to alert on any event that has the ET MALWARE on it

[L0n4]

you can use like this: `query: "suricata.eve.alert.signature: MALWARE*"` But in this case it may also include the MOBILE_MALWARE category.