Thats because most of the ElasticSearch data model is materialized indexes. You need to reindex (or use one of the other ops which amounts to building a composite index) to create different aggregates. Otherwise you need to use constructed JSON queries instead of adhoc lucene string searches to build the more complicated searches on those fields. Kibana provides tools that can help visualize building those if you don't do it from scratch, but its definitely a different workflow than Splunk or something implementing a more traditional query language.