query: >
    tags:syslog AND
    message:"oom-killer"