Trying to implement an "impossible travel" query

Elastic Stack Elasticsearch
1

I have an index with geo-tagged login records. Each document includes user, time and location for authentications. I want to find all instances where successive logins are impossible. The location and time of the latest login event for each user is compared to the prior login event. The difference in geo points and times that exceed a certain speed (air-travel) indicate impossible login situations. ( I am aware that VPNs and automated logins will produce noise ).

I could do this with an external script that calls the Elasticsearch REST API. However, I feel that I should be able to do this solely with Elasticsearch queries, perhaps creating a temporary index with pairs of the two most recent login events per user. I've only performed simple boolean queries. Any clues how I might accomplish this?

2

Hi! Looking to implement the same thing. Any progress on this? I'd hate to spend the time to build something if someone has already implemented it. I am sure they have because I have heard reference to it in regards to ELK but never actually came across how they accomplished it...

3

No joy. I'm going with Plan B: implement an external python script that uses the Elasticsearch API.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.