datafeed_source_ip_url_count_ecs.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "query": {
      "bool": {
        "filter": [
          { "term":  { "event.dataset": "nginx.access" } }
        ]
      }
    }
}