elastic stack 6.5.1. This question can be applied to any similar query to filter events.
I have visualised users (donut) who have logged in remotely. The inner ring shows users, the outer shows countries. Due to the large number of users, I have two views the the same data, UK and non-UK, but I would like to have one that only shows users who have remotely connected from more than country/city. Of course, this does show users who have multiple coloured outer ring segment, meaning multiple countries.
The raw data is similar to
userA "ip address 188.8.131.52" "country01" "100 times"
userA "ip address 184.108.40.206" "country02" "30 times"
userB "ip address 220.127.116.11" "country03" "2098 times"
I want to filter only users with multiple countries.
Thanks for your time.