add agregated search

README.md

@@ -218,6 +218,20 @@ usable data is available, the dashboard keeps showing the last good findings,
 graphs, incidents, and correlations with a stale-data warning instead of going
 blank.
 
+Graylog fetch mode controls how high-volume streams are read:
+
+- `raw`: fetch raw events up to `graylog_max_events_per_stream`.
+- `aggregate`: use Graylog MCP `aggregate_messages` for total event volume, then
+  fetch only `graylog_raw_sample_events` raw events per stream for findings and
+  drill-down context.
+- `auto`: use aggregate mode automatically when `graylog_max_events_per_stream`
+  is larger than `graylog_raw_sample_events`.
+
+For high EPS environments, keep `graylog_range_seconds` at 300, set
+`graylog_fetch_mode` to `auto` or `aggregate`, and use a modest raw sample such
+as 5000. The dashboard then shows aggregate event volume without forcing every
+raw log line through MCP each poll.
+
 ## Monitoring Export
 
 The dashboard also exposes Prometheus text metrics at: