datafeed_windows_rare_metadata_user.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
      "bool": {
        "filter": [{"term": {"destination.ip": "169.254.169.254"}}]
      }
    }
  }