gistfile1.txt

{
    "query": {
        "filtered": {
            "filter": {
                "bool": {
                    "must": [
                        {
                            "term": {
                                "EventID": 4728
                            }
                        },
                        {
                            "term": {
                                "TargetUserName.raw": "Domain Admins"
                            }
                        }
                    ]
                }
            },
            "query": {
                "match_all": {}
            }
        }
    },
    "sort": [
        "@timestamp"
    ]
}