Query to list Snort alerts indexed by unifiedbeat