✄𐘗
text code block:
✄𐘗FROM logs-network_traffic.amqp-*
| WHERE
    data_stream.dataset == "network_traffic.amqp" AND
    network_traffic.amqp.method == "queue.purge" AND
    network_traffic.amqp.`no-wait` == false AND
    network_traffic.status == "OK" AND
    client.ip IS NOT NULL AND
    server.ip IS NOT NULL AND
    network_traffic.amqp.queue IS NOT NULL
| STATS
    Esql.purge_count = COUNT(*),
    Esql.queue_count = COUNT_DISTINCT(network_traffic.amqp.queue),
    Esql.queues = VALUES(network_traffic.amqp.queue),
    Esql.first_purge = MIN(@timestamp),
    Esql.last_purge = MAX(@timestamp)
  BY client.ip, server.ip
| WHERE Esql.purge_count >= 3 AND Esql.queue_count >= 3
| SORT Esql.queue_count DESC, Esql.purge_count DESC
| KEEP client.ip, server.ip, Esql.purge_count, Esql.queue_count, Esql.queues, Esql.first_purge, Esql.last_purge