Remove false positives from query 1240256

Logstash doesn't appear to do exact matching for " 503 " so expand
query.

Change-Id: I83b83020a62cc1d50eb2960c51c0c1bdc751bf57
Merge "Remove false positives from query 1240256"