ret.code=404;   // no api
console.log('404');

fields @timestamp, @message
| sort @timestamp desc
| limit 20
| filter @message like /(?i)(404)/