title: Using Elastic Search to identify failed logins
body: <p>I have a certain use case that I'm researching involving creating a query that returns events whenever a failed login occurs from two separate accounts on one machine. </p>
  
  <p>I've created the following query, but I'm receiving errors whenever I try to run it. </p>
  
  <pre><code>{
  "query": {
      "filtered": {
         "query": {
              "match_all": {}
         },
         "filter" : {
             "term": {
                "EventID": "4625"
             }
         },
         "filter" : {
              "range" : { 
                  "_timestamp" : { 
                      "gt": "now-15m"
                  }
              }
          }
      }
  },
  aggs: {
      group_by_host: {
          terms: {
              field: 'hostname'
          },
          aggs: {
              group_by_user: {
                  terms: {
                      field: 'username'
                  }
              }
          }
      }
  }  
  </code></pre>
  
  <p>Any </p>