search and correlate logs

GET /logs-*/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "service.name": "order-processing" } },
        { "range": { "@timestamp": { "gte": "now-1h" } } },
        { "match": { "log.level": "ERROR" } }
      ]
    }
  }
}