Use case logic

Elastic Stack Logstash
1

We are working on the Use case that 'User access from different locations', whenever there is change in country name should be captured.

Below is the Scenario: kishore: India
kishore: USA
For the above scenario i was able to capture username and country name from the logs in the dictionary file to be used in Translate filter.

I need your assistance on logic, how to capture the change in country name

2

Extract username and country into fields, look up the username with the translate filter to get the last known country and compare that lookup result to the country you got from the log?