fields @timestamp, @message
| sort @timestamp desc