I spent last few years with Splunk and now I’m an ELK user. I’d like to know if there is a way to perform a statistical search in ELK.
Let’s say, I have some firewall logs and I’d like to use it to detect a port scan behaviour. Here’s the query I’ll use in Splunk:
index=my_firewall_index | stats dc(dest_port) as unequal_dest_port by source_ip | where unequal_dest_port > 50
Could you please provide an ELK equivalent for this search?