✄𐘗
text code block:
✄𐘗from packetbeat-*, filebeat-*, logs-network_traffic.* metadata _id, _version, _index
| where (
    data_stream.dataset in ("network_traffic.tls", "network_traffic.http") or
    (event.category in ("network", "network_traffic") and network.protocol == "http")
  )
| where network.transport == "tcp"
| where url.full RLIKE "http://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}/cd"
| where destination.port in (53, 80, 8080, 443)
| keep @timestamp, url.full, source.ip, destination.ip, destination.port, network.protocol, data_stream.dataset, _id, _version, _index