As far as I have seen, you can directly provide the content in the search and it works with (best practice) or without quotes.
e.g. index=abc http://
index=abc "http://"
surrounding the search string in double quotes should be sufficient (ie. "Server: Apache"). Is that not working?
The data is in JSOn format, would that make a difference?