Visual alert exact phrase doesn't appear to be functioning properly

I have a visual alert set up. What I am trying to do is send an alert message if more than X number of events appear with the exact phrase “Could not index event”
But instead what I seem to be getting is a count of the number of events period, or possibly its doing something like ‘could or index or event’
How do I get an accurate result with an exact phrase query

I only have 2 events in the time window with that phrase.