Non-blocking - it might be easier to read this function just included the full query definition, rather than trying to figure out where everything was assembled?  That's just stylistic though.

Also, I wonder if the query needs both is_error:True and is_error:False - that was so that kibana could count how many errors vs non-errored events there were.  We may only need one, if we wanted to provide a query arg for error events only.

Also, non-blocking, but possibly something to think about - is limiting the number of events per page?  (like maybe 100, and allowing to query the next page?)