from * metadata _id, _index, _version | where winlog.channel=="Security" and event.code=="1102"
