Issue Summary

This is reproducible on Data Center: YES

Steps to Reproduce

1. Add an email integration with the either the create filter set to match "message" "contains"  "alarm that has recovered"
2. Send email an email with "Close string: AWS Incident Detection and Response received an alarm that has recovered for your workload." in the message field (body of the email).

Expected Results

It should create an alert. 

Actual Results

No alert is created and the logs show that it did not match the filter. 

Additional context

If you change the text in the message body of the email to "any text an alarm that has recovered for your workload." it will work. 

Looking at the raw payload, it seems to be adding line breaks for some reason, which are altering the part of the message that the filter is looking to match.

"message": "Close string: AWS Incident Detection and Response received an alarm that\r\nhas recovered for your workload.",

Workaround

N/A