The below always returns all docs. We want to limit the return set to 2:
input {
Read all documents from Elasticsearch matching the given query
elasticsearch {
hosts => "xxx.xxx.xxx.xxx:9202"
index => "rrdb_matter_1"
query => '{"_source":[ "matter_id"],"size":2,"query": {"match_all": {} }}'
}
}