new ES query to test for graylog2 data in ES in INSTALL doc