Case in point, my dumbass can't work out how to make an array in ES|QL so that I can say (source.address IN array OR destination.address IN array) without having to type out the array twice.