Hello,
I'm trying to figure out how to search and compare values in subsequent/sequential JSON messages where a user is the same.
Scenario: "UserA" auth-validates from location A, but finishes authentication from location B. Auth validation and auth completion messages are in two separate JSON blobs of different types (one for auth-validation one for auth-success). I'd like to show a table by user showing: User, Validation City, Success City.
In pseudo code:
[Event A] message.Type="auth-validation" for "UserA" = client.City "x" and in a subsequent JSON entry for "UserA", [Event B] message.Type"auth-success" NOT = client.City="x"
Example fields I'm working with:
index=auths
(example of event at 03:45:01AM) user="UserA" message.Type="auth-validation" client.City="Los Angeles"
(example of event at 03:45:02AM) user="UserA" message.Type"auth-success" client.City="Houston"
... View more