watch.json

{
  "metadata": {
    "window_period": "5m"
  },
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": "logins",
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-{{ctx.metadata.window_period}}"
                    }
                  }
                }
              ],
              "should": [
                {
                 "terms": {
                   "event_type": [
                     "add",
                     "remove"
                   ]
                 } 
                }
              ]
            }
          },
          "aggs": {
            "event_types": {
              "filters": {
                "filters": {
                  "add": {
                    "term": {
                      "event_type": {
                        "value": "add"
                      }
                    }
                  },
                  "remove": {
                    "term": {
                      "event_type": {
                        "value": "remove"
                      }
                    }
                  }
                }
              },
              "aggs": {
                "users": {
                  "terms": {
                    "field": "user",
                    "size": 1000
                  }
                }
              }
            }
          },
          "size": 0
        }
      }
    }
  },
  "condition": {
    "script": {
      "id": "condition"
    }
  },
  "throttle_period": "5m",
  "actions": {
    "log": {
      "transform": {
        "script": {
          "id":"transform"
        }
      },
      "logging": {
        "text": "Users added and removed in the last {{ctx.metadata.window_period}}:{{#ctx.payload._value}}{{.}}:{{/ctx.payload._value}}"
      }
    }
  }
}