{
    "query": {
        "bool": {
            "must": {
                "query": {
                    "match_phrase": {
                        "message":"system restart"
                    }
                }
            },
            "must": {
                "range": {
                    "timestamp": {
                        "gte": "now-24h"
                    }
                }
            }
        }
    }
}