How to derive "enabled":false part from the data.representation filed using DQL (Opensearch Dashboard Query Language)
The log as below
data.representation {"enabled":false,"totp":false,"emailverified":false,"}}
I have tried the following without any success
location : "/opt/wazuh/keycloak/admin.log" and data.representation :"enabled":false
location : "/opt/wazuh/keycloak/admin.log" and data.representation : {enabled:false}
location : "/opt/wazuh/keycloak/admin.log" and data.representation : "enabled":false