datafeed_high_count_by_destination_country.json

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "max_empty_searches": 10,
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "event.category": "network"
          }
        },
        {
          "exists": {
            "field": "destination.geo.country_name"
          }
        }
      ]
    }
  }
}