@bumpy-needle-3184 thank you, found this thread a moment ago and looking into it. Seems event logs are kept in separate files like .ds-datahub_usage_event-00000x. When I run curl -X GET 'localhost:9200/.ds-datahub_usage_event-000001/_search?size=10000 it gives me only first 10k results, so I appended track_total_hits=true option at the end of the query like curl -X GET 'localhost:9200/.ds-datahub_usage_event-000001/_search?size=10000&track_total_hits=true' > /tmp/result.txt. It gives me all rows in JSON format. Just for info.