How to track if {{server}} changes {{geo.location}}

Elastic Stack Elasticsearch
2

Are you looking into Elastic Security or Alerting rules for this? Just wondering.

Maybe I would suggest try creating a transformation job for this. For example Impossible Travel rule :

If that does not meet your needs, you can still use a transformation rule to group by a unique field and aggregate by the location field.