Elastic KQL Builder

# Index: logs-*
# Time: last 15m

message: *timeout*

# Useful KQL patterns:
# error AND service.name: "api"
# http.response.status_code: 5*
# NOT log.level: "debug"
# message: *timeout* OR message: *connection refused*