This is the crux of the problem. If you're purely processing internal logs on an internal service, you're probably good. If you're exposing an API or a UI to

This is the crux of the problem. If you're purely processing internal logs on an internal service, you're probably good. If you're exposing an API or a UI to paying customers which calls Elastic search to run a query, then it's maybe not great. Everything needs to be caveated with "maybe" or "possibly", because nobody knows how it'd go in court.