The e-r query for bug 1257626 is not hitting

[Matt Riedemann]

The query in this patch works in logstash:

https://review.openstack.org/#/c/59919/

http://logstash.openstack.org/#eyJzZWFyY2giOiJtZXNzYWdlOlwibm92YS5jb21wdXRlLm1hbmFnZXIgVGltZW91dDogVGltZW91dCB3aGlsZSB3YWl0aW5nIG9uIFJQQyByZXNwb25zZSAtIHRvcGljOiBcXFwibmV0d29ya1xcXCIsICBSUEMgbWV0aG9kOiBcXFwiYWxsb2NhdGVfZm9yX2luc3RhbmNlXFxcIlwiIEFORCBmaWxlbmFtZTpcImxvZ3Mvc2NyZWVuLW4tY3B1LnR4dFwiIiwiZmllbGRzIjpbXSwib2Zmc2V0IjowLCJ0aW1lZnJhbWUiOiI2MDQ4MDAiLCJncmFwaG1vZGUiOiJjb3VudCIsInRpbWUiOnsidXNlcl9pbnRlcnZhbCI6MH0sInN0YW1wIjoxMzg5MjE5MzMyMzcwfQ==

The problem is it only hits on gate-tempest-dsvm-large-ops which either isn't getting checked or something is broken, since it should be checked by elastic-recheck.

[Matt Riedemann (mriedem)]

e-r reported on that bug here: https://review.openstack.org/#/c/57358/