Find users (IP adresses) which only access one group of servers

Elastic Stack Kibana
2

I tried a simplified version of your issue and got something to share. Maybe it is not exactly what you want but it may give you some pointers.

This is the data I used:

/* Clean up */
DELETE discuss-328714-data

/* Create a test index */
PUT discuss-328714-data
{
  "mappings": {
    "properties": {
      "ts": { "type": "date"},
      "ip": { "type": "keyword"},
      "proxy": { "type": "keyword"}
    }
  }
}

/* Add some data to the index */
POST discuss-328714-data/_bulk
{ "index": {}}
{"ts": "2023-03-13", "ip": "1.1.1.1", "proxy": "p1"}
{ "index": {}}
{"ts": "2023-03-14", "ip": "1.1.1.1", "proxy": "p1"}
{ "index": {}}
{"ts": "2023-03-15", "ip": "1.1.1.1", "proxy": "p1"}
{ "index": {}}
{"ts": "2023-03-16", "ip": "1.1.1.1", "proxy": "p1"}
{ "index": {}}
{"ts": "2023-03-13", "ip": "1.1.1.2", "proxy": "p1"}
{ "index": {}}
{"ts": "2023-03-14", "ip": "1.1.1.2", "proxy": "p2"}
{ "index": {}}
{"ts": "2023-03-15", "ip": "1.1.1.2", "proxy": "p1"}
{ "index": {}}
{"ts": "2023-03-16", "ip": "1.1.1.2", "proxy": "p2"}
{ "index": {}}
{"ts": "2023-03-13", "ip": "1.1.1.3", "proxy": "p2"}
{ "index": {}}
{"ts": "2023-03-14", "ip": "1.1.1.3", "proxy": "p2"}
{ "index": {}}
{"ts": "2023-03-15", "ip": "1.1.1.3", "proxy": "p2"}
{ "index": {}}
{"ts": "2023-03-16", "ip": "1.1.1.3", "proxy": "p2"}

So there is an index with a date, an IP, and a proxy identifier. I created a Data View on this index with the defaults.

Then in Lens I created a table

image
image1000×562 33.4 KB

These are the settings:

For rows I got the top values for IPs ranked by the ascending number of unique count on the proxy.keyword field so it lists first those hitting a single proxy

image
image551×997 40 KB

And then for the metric I again get the unique count for the proxy field adding a custom color ramp to render on green those with count 1 and in red those with count 2 or more, you get the idea.

image
image470×1006 38.2 KB

That's it! let me know if this helps.