from logs-nginx.error-*, logs-apache_tomcat.error-*, logs-apache.error-*, logs-iis.error-*
| keep
    @timestamp,
    event.type,
    event.dataset,
    source.ip,
    agent.id,
    host.name
| where source.ip is not null
| stats
    Esql.event_count = count(),
    Esql.host_name_values = values(host.name),
    Esql.agent_id_values = values(agent.id),
    Esql.event_dataset_values = values(event.dataset)
    by source.ip, agent.id
| where
    Esql.event_count > 25