gistfile1.json

{
  "facets": {
    "0": {
      "query": {
        "filtered": {
          "query": {
            "query_string": {
              "query": "\"server is active\" AND audit_log_event_source:true"
            }
          },
          "filter": {
            "bool": {
              "must": [
                {
                  "range": {
                    "@timestamp": {
                      "from": 1406530800000,
                      "to": 1407135600000
                    }
                  }
                },
                {
                  "fquery": {
                    "query": {
                      "query_string": {
                        "query": "tags:(otter)"
                      }
                    },
                    "_cache": true
                  }
                }
              ],
              "must_not": [
                {
                  "fquery": {
                    "query": {
                      "query_string": {
                        "query": "host:(\"api0.preprod.ord.as.rax.io\")"
                      }
                    },
                    "_cache": true
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "size": 0
}