gistfile1.txt

{
  "query": {
    "filtered": {
      "query": {
        "query_string": {
          "query": "categoryBehavior:\"/Authorization*\" OR categoryBehavior:\"/Authentication*\" -(categoryBehavior:\"/Authorization/Verify\") -(categoryBehavior:\"/Authentication/Verify\")",
          "analyze_wildcard": true
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "query": {
                "term": {
                  "eventId": "21785"
                }
              }
            }
          ]
        }
      }
    }
  }
}