logstash input elasticsearch query