datafeed_high_distinct_count_error_message.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
        "bool": {
            "filter": [
                {"term": {"event.dataset": "aws.cloudtrail"}},
                {"term": {"event.module": "aws"}},
                {"exists": {"field": "aws.cloudtrail.error_message"}}
            ]
        }
    }
}