ESA 'Group by' issue
I have 2 events with alias_host array meta as below. Event1: "alias.host":["google.com","outlook.com","bing.com"] Event2: "alias.host":["msn.com","google.com","microsoft.com"] Anyone have tip how to group by alias_host in ESA EPL rule? How to compare...