query: >
  (
  (message:"Expected running services not running:"
  AND NOT message:"q-fwaas")
  OR
  message: "Too many retries, giving up"
  )
  AND tags:console