KQL syntax for serial difference/delta filter

That's not what KQL is for. As documented, KQL is only capable of filtering documents: Kibana Query Language | Kibana Guide [7.11] | Elastic