Search pattern has influence on ressources needed in elasticsearch

## Current Behavior

It makes a difference how you type in a query:

`eventid: ( 5827 OR 5828 OR 5829 OR 5830 OR 5831)`

is less expensive to elasticsearch than:

`eventid:5827 OR eventid:5828 OR eventid:5829 OR eventid:5830 OR eventid:5831`

## Context
It should not make a difference how you write the query as that is normalized by Graylog itself.

We have observed that in environments that have lots of data and are under load this can be a real problem. We need to look into that in details to check if we can improve this.

[z#844334]