Elasticsearch ds. How to use multiple fields to create single metric

Here is my json below. I am trying to take the two parameters “eventName”: “ConsoleLogin”, and “MobileVersion”: “Yes”. I want to send an alert whenever someone uses the MobileVersion. The added bonus would be if I could customize the alert to specify the username. Is that possible?

-Rick M

“_index”: “logging-xxx”,
“_type”: “_doc”,
“_id”: “cxxxxxxxfxxxc”,
“_version”: 1,
“_score”: null,
“_source”: {
“eventSource”: “signin.amazonaws.com”,
“eventName”: “ConsoleLogin”,
“sourceIPAddress”: “x.x.x.x”,
“additionalEventData”: {
“LoginTo”: “https://console.aws.amazon.com/iam/home?region=us-east-1&state=hashArgs%23&isauthcode=true”,
“MobileVersion”: “No”,
“MFAUsed”: “Yes”