datafeed_v3_windows_rare_metadata_process.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
      "bool": {
        "filter": [
          {
            "term": {
              "host.os.family": "windows"
            }
          },
          {
            "term": {
              "destination.ip": "169.254.169.254"
            }
          }
        ]
      }
    }
}