gistfile1.txt

{
    "size": 50,
    "sort": [ { "@timestamp": { "order": "desc" } } ],
    "query": {
                "bool": {
                    "must": [
                        {
                            "range": {
                                "@timestamp": {
                                    "from": "now-5m",
                                    "to": "now"
                                }
                            }
                        },
                        {
                          "term": { "type": "cloudtrail" }
                        }
                    ],
                    "must_not": [
                        { "query_string": { "query": 'eventName:Describe* Get* List* UpdateStack CreateStack DownloadDBLogFilePortion RegisterInstancesWithLoadBalancer DeregisterInstancesFromLoadBalancer' } },
                        { "query_string": { "query": 'userAgent:cloudformation.amazonaws.com' } },
                        { "query_string": { "query": 'eventName:XXX*' } },
                    ],
               }
    }
}