just another doubt: if I don't specify any query, does the first run will execute a query match_all?
if in the meantime the source index will be updated with other new docs, does Logstash input will get them or not? I mean, the first run will work as a "snapshot" (not literally of course)?