✄𐘗
text code block:
✄𐘗FROM logs-vsphere.log-*
| WHERE data_stream.dataset == "vsphere.log" AND event.module == "vsphere"
    AND message LIKE "*pam_do_authenticate: error*"
| GROK message "%{DATA}rhost=%{IP:source_ip}%{DATA}login:%{DATA:user}]%{GREEDYDATA}"
| WHERE user IS NOT NULL AND source_ip IS NOT NULL
| EVAL user.name = user, source.ip = source_ip
| STATS
    Esql.failure_count = COUNT(*),
    Esql.first_seen = MIN(@timestamp),
    Esql.last_seen = MAX(@timestamp),
    Esql.message_values = VALUES(message)
  BY user.name, source.ip, host.ip
| WHERE Esql.failure_count >= 3
| EVAL message = MV_FIRST(Esql.message_values)
| KEEP message, user.name, source.ip, host.ip, Esql.failure_count, Esql.first_seen, Esql.last_seen, Esql.message_values