How do you detect any malicious traffic through baselines via Amazon's Elastiservice?

I am looking for an effective way to parse through all the data

FYI the aws service is not Elasticsearch and we do not provide support for it here.

Please do feel free to upgrade to the official Elasticsearch Service here - Elastic Cloud: Hosted Elasticsearch, Hosted Search | Elastic - which includes a tonne of features around what you are looking for.