default.search

{
  "index": "{{index}}",
  "scroll": "30s",
  "search_type": "dfs_query_then_fetch",
  "size" : {{fetchsize}},
  "body": {
    "query": {
      "bool": {
        "must": [
          {
            "range": {
              "timestamp": {
                "gt": "{{from}}",
                "to": "now"
              }
            }
          },
          {
            "query_string": {
              "query": "@log_name:{{app}}.log",
              "analyze_wildcard": true
            }
          }
        ],
        "must_not": [
          {
            "constant_score": {
              "filter": {
                "missing": {
                  "field": "message"
                }
              }
            }
          },
          {
            "constant_score": {
              "filter": {
                "missing": {
                  "field": "timestamp"
                }
              }
            }
          }
        ],
        "should": []
      }
    },
    "sort": [{
      "timestamp": {
        "order": "asc",
        "ignore_unmapped": true
      }
    }]
  }
}