This is certainly the easiest way to paginate!  This may result in some interesting behavior though, because if the user then gets the next page, they may get some repeat audit log events.  Because it does a new query, and indexes from that new query.

For example, if the user requests audit logs for the last 30 days, and wants to get the next 20 (thus passing start=20), then the next query gets the audit logs from now (at the time of the second query).  There may have been 20 or 30 more new logs, and an index of 20 may put the user forward in time, rather than backwards in time.

I don't think I'm explaining this well.   But something like what's explained here:  "http://elasticsearch-users.115913.n3.nabble.com/Is-ES-capable-of-doing-pagination-td3399087.html"

I think perhaps we need to do pagination via the range query on time?  So the marker for the current page will be the oldest timestamp, and then the next page will be 30 days ago until that timestamp (as opposed to 30 days ago until now).