Find servers whose last logged event was "error"

Elastic Stack Elasticsearch
5

I've taken the liberty of renaming your question subject because

  1. It should help others with the same business problem find this topic
  2. We moved away from "top hits" as being the problem