Fetch unique values of field in Similar logs

[deadPix3l (Skyler Curtis)]

I have an index with about a quarter million logs and growing.
many logs are exactly the same except one field. ie. (only an example)
{
event_id: 1265,
reason: "permission denied",
file: "/etc/shadow"
process: "chrome.exe",
host: "box_A"
}

sometimes an identical event occurs on multiple hosts. How can i get from "What events happened on host A?" to "for each of those, what other hosts did they occur on?"

How do i view all identical events which occured on more than X different hosts, and find out which hosts those were?

[bhavyarm]

Hi,

This is a simple terms agg in a datatable in my local:

I am looking at the count of documents which contain that city name.

So instead of count here - you can use other agg.

Does it help?

Thanks,
Bhavya

[deadPix3l (Skyler Curtis)]

I'm currently using unique count, but it's not perfect.

So for each event_id or for each process, which are not unique to the log, I can see a count of how many unique hosts have had such an event. So for 1265, let's say I get 4. 4 hosts have experienced as 1265 ("permission denied") error. Now do I get from that to which 4 are they, for all (or top 100?) error codes.