diff --git a/lib/logstorage/parser.go b/lib/logstorage/parser.go
index ca4dcc45b..d4970c6d2 100644
--- a/lib/logstorage/parser.go
+++ b/lib/logstorage/parser.go
@@ -889,7 +889,7 @@ func parseGenericFilter(lex *lexer, fieldName string) (filter, error) {
 }
 
 func getCompoundPhrase(lex *lexer, allowColon bool) (string, error) {
-	stopTokens := []string{"*", ",", "(", ")", "[", "]", "|", "!", ""}
+	stopTokens := []string{"*", ",", "(", ")", "[", "]", "|", ""}
 	if lex.isKeyword(stopTokens...) {
 		return "", fmt.Errorf("compound phrase cannot start with '%s'", lex.token)
 	}
@@ -906,7 +906,7 @@ func getCompoundPhrase(lex *lexer, allowColon bool) (string, error) {
 
 func getCompoundSuffix(lex *lexer, allowColon bool) string {
 	s := ""
-	stopTokens := []string{"*", ",", "(", ")", "[", "]", "|", "!", ""}
+	stopTokens := []string{"*", ",", "(", ")", "[", "]", "|", ""}
 	if !allowColon {
 		stopTokens = append(stopTokens, ":")
 	}
@@ -918,7 +918,7 @@ func getCompoundSuffix(lex *lexer, allowColon bool) string {
 }
 
 func getCompoundToken(lex *lexer) (string, error) {
-	stopTokens := []string{",", "(", ")", "[", "]", "|", "!", ""}
+	stopTokens := []string{",", "(", ")", "[", "]", "|", ""}
 	if lex.isKeyword(stopTokens...) {
 		return "", fmt.Errorf("compound token cannot start with '%s'", lex.token)
 	}
diff --git a/lib/logstorage/parser_test.go b/lib/logstorage/parser_test.go
index 36cf65da6..853f380c7 100644
--- a/lib/logstorage/parser_test.go
+++ b/lib/logstorage/parser_test.go
@@ -946,8 +946,8 @@ func TestParseQuerySuccess(t *testing.T) {
 	f("foo-bar+baz*", `"foo-bar+baz"*`)
 	f("foo- bar", `"foo-" bar`)
 	f("foo -bar", `foo !bar`)
-	f("foo!bar", `foo !bar`)
-	f("foo:aa!bb:cc", `foo:aa !bb:cc`)
+	f("foo!bar", `"foo!bar"`)
+	f("foo:aa!bb:cc", `foo:"aa!bb:cc"`)
 	f(`foo:bar:baz`, `foo:"bar:baz"`)
 	f(`foo:(bar baz:xxx)`, `foo:bar foo:"baz:xxx"`)
 	f(`foo:(_time:abc or not z)`, `foo:"_time:abc" or !foo:z`)