I have two solutions for you! Just replace "YOURFIELDHERE" with whatever the field name the string you're working with is in.
The first uses an eval statement to look through your field to find any part of the string that matches "boot". If it finds it, it will create a new value under the "NEWFIELD" that provides a log entry with the string "Failed Alert Reboot".
| eval NEWFIELD = if(lower(YOURFIELDHERE) LIKE "%boot%", "Failed Alert Reboot", null)
Alternitvely, you can use the "rex" command to search your data for the word boot. This will match any instance of "boot" it finds in the data, and returns "BOOT" as the field value for the newly created failed_alert_reboot field.
| rex field=YOURFIELDHERE "(?i)(?<failed_alert_reboot>boot)"
Let me know if these don't work for you or if you need help!